wouldn't it be better to also call them "http.authUser" and "http.authPass" ?