better detect disable http auht