If I move it to the read() method, then the htpasswdFile could be
  changed to a different one without a restart.Are thee any reasons
  not to allow this?

That would be preferable, actually.  I try to make most settings
hot-reloadable without a restart.