use httpauthfilter for authentication