Probably best to tack the http_auth onto the end since that'll change the ordering where most people not defaulting to version 3 or specifying a different time format will have something that isn't valid for the http_auth value already there. This will keep things cleaner moving forward.

If you'll sort that out I can merge these changes in and get a 0.5.1 bump rolled out after some quick testing.