@mediatemple you have bizzarre restrictions on htaccess files. It is impossible to prevent http authentication over an insecure channel.