hardcoded links in auth (lamest aspect of HTTPS workaraound)