Auth in Apache is covered in this document.

You shouldn't be able to see the .htaccess file, otherwise people could see it and, perhaps, figure out how to circumvent it.
_________________________
Bitt Faulk