http: don't always prompt for password