I think we're better to still redirect to login here.
Call ```http_auth_login()``` further up ( if still not logged in after ```auto_login()``` ). That way we'd basically accept http auth login on ALL requests.