pulled httpauth again...moved validation to where it's supposed to be...