FIX: order of parsing app.http.auth
UPGRADE: paks