allow auth in URL for HTTP APIs, stream & no-stream