correct httpauth