using env vars for http auth