By adding support for auth groups, you can avoid frequent rewrites of your .htaccess file, along with keeping it short.

# in .htaccess
AuthType basic
AuthDBMGroupFile /path/to/.htpasswd
AuthDBMUserFile /path/to/.htpasswd
require group user,admin
[download]

This is set up to use a single User- and GroupFile. Add a colon and a comma seperated list of auth groups to the crypted password entry in .htpasswd. I've assumed mod_auth_dbm here. See the Apache docs for details.

After Compline,
Zaxo