move http auth to application controller