diff --git a/registry/client/auth/addr.go b/registry/client/auth/addr.go
index ca987f34..6e777528 100644
--- a/registry/client/auth/addr.go
+++ b/registry/client/auth/addr.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 )
 
-// FROM: http://golang.org/src/net/http/client.go
+// FROM: https://golang.org/src/net/http/http.go
 // Given a string of the form "host", "host:port", or "[ipv6::address]:port",
 // return true if the string includes a port.
 func hasPort(s string) bool { return strings.LastIndex(s, ":") > strings.LastIndex(s, "]") }
@@ -16,9 +16,9 @@ var portMap = map[string]string{
 	"https": "443",
 }
 
-// CanonicalAddr returns url.Host but always with a ":port" suffix
+// canonicalAddr returns url.Host but always with a ":port" suffix
 // FROM: http://golang.org/src/net/http/transport.go
-func CanonicalAddr(url *url.URL) string {
+func canonicalAddr(url *url.URL) string {
 	addr := url.Host
 	if !hasPort(addr) {
 		return addr + ":" + portMap[url.Scheme]
diff --git a/registry/client/auth/authchallenge.go b/registry/client/auth/authchallenge.go
index a208ec6b..69d9d6fe 100644
--- a/registry/client/auth/authchallenge.go
+++ b/registry/client/auth/authchallenge.go
@@ -56,7 +56,7 @@ type simpleChallengeManager struct {
 
 func normalizeURL(endpoint *url.URL) {
 	endpoint.Host = strings.ToLower(endpoint.Host)
-	endpoint.Host = CanonicalAddr(endpoint)
+	endpoint.Host = canonicalAddr(endpoint)
 }
 
 func (m *simpleChallengeManager) GetChallenges(endpoint url.URL) ([]Challenge, error) {
@@ -78,9 +78,10 @@ func (m *simpleChallengeManager) AddResponse(resp *http.Response) error {
 		Host:   resp.Request.URL.Host,
 		Scheme: resp.Request.URL.Scheme,
 	}
+	normalizeURL(&urlCopy)
+
 	m.Lock()
 	defer m.Unlock()
-	normalizeURL(&urlCopy)
 	m.Challanges[urlCopy.String()] = challenges
 	return nil
 }
diff --git a/registry/client/auth/authchallenge_test.go b/registry/client/auth/authchallenge_test.go
index ef26ba76..2716fba5 100644
--- a/registry/client/auth/authchallenge_test.go
+++ b/registry/client/auth/authchallenge_test.go
@@ -73,7 +73,7 @@ func testAuthChallengeNormalization(t *testing.T, host string) {
 
 	lowered := *url
 	lowered.Host = strings.ToLower(lowered.Host)
-	lowered.Host = CanonicalAddr(&lowered)
+	lowered.Host = canonicalAddr(&lowered)
 	c, err := scm.GetChallenges(lowered)
 	if err != nil {
 		t.Fatal(err)