no HTTPS for auth