make http auth a secret again