added http auth, closes #4