auth uses https