cleaner usage of http_auth spoofing
fixes #8978 routing error on searching users