fixed the authentication

authentication works with form validation. error & success msgs are
passed to the target page. failed form session data is added to the
$_SESSION array so that the forms can be repopulated. Restored the
htaccess, as that was not the source of the problem