http: rework authentication handling - only retry internally for GET requests