replace HTTP authentication with forms authentication