FIX: parsing order for app.http.auth