do we ever use auth over http?