changed:  now using external site to demo HTTP Auth