use http auth instead this