require http authentication for static html pages as well.
should help browsers being less confused than just requiring it for RPC.