more efficient http auth check