turn httpauth back on and add uniqueness validation