http auth for the api