always use HTTP for S3 auth