title: .htaccess allows everyone once first successful login
body: <p>I'm trying to protect a single URI path. In the browser, it pops up the user / pass like normal. Once authenticated, any browser from any IP has access to that path. I'm not sure what I've got messed up.</p>
  <p>/var/www/path/to/site/.htaccess:</p>
  <pre><code>&lt;If &quot;%{REQUEST_URI} =~ m#/protect-me/?#i&quot;&gt;
      AuthUserFile /var/www/path/to/site/.htpassword
      AuthName &quot;Password protected&quot;
      AuthType Basic
      Require valid-user
  &lt;/If&gt;
  </code></pre>
  <p>mysite.conf:</p>
  <pre><code>&lt;VirtualHost &gt;
  ...
      &lt;Directory /var/www/path/to/site/&gt;
        Options -Indexes +FollowSymLinks -MultiViews
        AllowOverride All
      &lt;/Directory&gt;
  ...
  &lt;/VirtualHost&gt;
  </code></pre>