moved authentication to /authentication/http