clarity about htpasswd