use env vars for http auth