update to htaccess for password protection