Also use HTTP auth for the api