remove http auth from admin area;
TODO: implement app auth module