htaccess mechanism works more reliably now.

Re-architecting the entire htaccess mechanism will be necessary in the future,
possibly by putting the functionality into a "before request" handler, that will
handle checking for .htaccess files, and installing/removing the auth tool on
the appropriate paths.
Merge branch 'htaccess-bugfix'

Closes #161.