Also use HTTP endpoints for auth and access. This is unsafe!

- This will allow the tokens to be read in clear by anyone in the
middle.
Prepare 1.1.1 release, not public for now.