optional http auth on public side