auth and an http thingo