http: add an "auto" mode for http.emptyauth