http: restrict auth methods to what the server advertises