move htpasswd out of vhost as it declares more than once