do not build an Options object at each call
add tests for http authorization