use http for non-login.