In general, I'm of the opinion that authentication and authorization should not be part of the application, instead it should be an add-on. That is, in principle, one shouldn't need to change application code to add authentication. The simplest way, in Apache with Basic authentication, is to put (alias, mod_rewrite) the member-only apps in a directory, and protect it with, say,
.