No, the applet can be used. However, Kerberos and the plug-in is required for 'single sign on'. Static web pages can be configured by the existence of a configuration file in the directory or via the global configuration file of the server. Yes, a module for the web server is required. A separate module per CGI or application is not required.
Authorization is specified in the manner determined by the web server.
For example, with apache the information about which directories are protected, what authorization is required and group information can be placed in the httpd.conf or in .htaccess files. The .htaccess file needs to be read for every request. The httpd.conf is only read at server startup or if the server is told the httpd.conf file changed. Generally for performance its better to put protection info in httpd.conf. For flexibily in having the publishers of data control thier own protections a .htaccess file is best.