FIX: order of parsing app.http.auth