diff --git a/osgi.enroute.websecurity.adapter/src/osgi/enroute/websecurity/adapter/SecurityFilter.java b/osgi.enroute.websecurity.adapter/src/osgi/enroute/websecurity/adapter/SecurityFilter.java
index f0dcce4..5568d36 100644
--- a/osgi.enroute.websecurity.adapter/src/osgi/enroute/websecurity/adapter/SecurityFilter.java
+++ b/osgi.enroute.websecurity.adapter/src/osgi/enroute/websecurity/adapter/SecurityFilter.java
@@ -46,6 +46,7 @@ public class SecurityFilter implements Filter {
 	private AtomicReference<AuthorityAdmin>		authorityAdminRef	= new AtomicReference<AuthorityAdmin>();
 	private volatile boolean					reported;
 	private String								realm;
+	private boolean 							allowAuthOverNonSecureLine 	= false;
 
 	interface Config {
 		@Meta.AD(deflt = DEFAULT_REALM)
@@ -56,6 +57,11 @@ interface Config {
 		String filter();
 
 		String alias();
+		
+		@Meta.AD(deflt = "false", description="Authentication over non-secure lines is dangerous. "
+											+ "But sometimes it is necessary, eg behind a reverse "
+											+ "proxy which handles HTTPS. ")
+		boolean allowAuthOverNonSecureLine();
 	}
 
 	/*
@@ -89,8 +95,10 @@ public Void call() throws Exception {
 		// and an open line is basically all,well, eh, open
 		//
 
-		if (!req.isSecure())
+		if (!allowAuthOverNonSecureLine && !req.isSecure()) {
 			run(null, runAs);
+			return;
+		}
 
 		if (req instanceof HttpServletRequest) {