moved location of http auth above proxy pass