http: avoid NULL dereference