auth refactoring: part 3

moving htpasswd out