changes to support apps that use http-auth. other tweaks.