Draft: http_auth: fix invalid frees

and tidy up error handling of this function slightly to avoid unnecessary free calls on null pointers in doing so.

Split from !1085 (closed).