Allow for multiple users/pws in http_auth secrets

 - cmd.run names property appears to be inconsistent. It seems as if
there is no guarantee that salt executes the commands in the same
order as the template for loop

- explicitly clear auth_file prior to running htpasswd so reliance
on cmd.run order is not necessary

(Fix proposed by Pesach , one of our ccj tenthwave collaborators.)