- merge htaccess with main apache file - show a meaningfull error message - do not put .htpasswd file into webroot, so no need to prevent download - reuse existing variable