use http auth for production