disable_http_auth as an option