refactor http auth