Added a little extra security by refusing to Challenge for auth when on HTTP