Put http auth condition before include or it may never be executed.

It is pretty probable that the file included at the end of vcl_recv contain inconditional return calls (like the drupal one) and the http auth condition may never be considered.