added optional http-auth (disabled by default)