http auth do not use sessions.