http: do not set up curl auth after a 401