Ok, i have tried a ton of stuff, but can't seem to get password
protection working on a website.

here's what i have so far:

/Library/WebServer/Documents/web/.htaccess
---
AuthName "Login"
AuthType Basic
AuthUserFile /Library/WebServer/Documents/.htpasswd
AuthGroupfile /dev/null
require user friends
---

/Library/WebServer/Documents/.htpasswd
---
friends:MSg7LpjK8YMIg
---

httpd.conf
---
....
<Directory /Library/WebServer/Documents/web>
AllowOverride All
</Directory>
....
---

jmroach.conf (which is also being read for some reason when i start
apache)
---
<Directory "/Library/WebServer/Documents">
AllowOverride All
</Directory>

AccessFileName .htaccess
---

apachectl start yields:

Processing config directory: /private/etc/httpd/users/*.conf
Processing config file: /private/etc/httpd/users/jmroach.conf

i have edited all .conf files there (and grep'd to make sure) with:
AllowOverride All

I get no popup window asking for a password at any point. I should get
one when i try to access webpages located in ".../web", right?

any help on this would be greatly appreciated as i'm frusterated as
hell!

thanks,

-john