I've never really liked using .htaccess files, why put the access control file in a web accessable directory? I always just put something like this in my httpd.conf:
CODE
<Directory /path/to/password/protect>
AuthType Digest
AuthName foo.com
AuthDigestFile /path/to/password/file
Require user mary john joe
Options FollowSymLinks
AllowOverride None
</Directory>
To create the password file you run htdigest located in apaches bin dir:
CODE
/usr/local/apache2/bin/htdigest -o /path/to/password/file foo.com mary
Use -o if this is a new file. Notice that this is auth_digest, not auth_basic, you might have to recompile apache with --with-auth-digest for this to work.