what about not using htaccess and using both sessions (or cookies) and a table to store login& password ?
At loading, check that the user is the real one, if not show him a login prompt, made in php, if he gives the right couple (login/password), display the page, else use a header("Location: somewhere ") to hide the page....
This plus an apache configuration forbiding to see a directory index shall do ?