do not require login if config.authenticate is not defined
remove http module, we don't use it
logging start and finish of request handling