updated for HTTP authentication

also cleaned up default behavior to match comments