You are right. play a little with the .htaccess:

AuthUserFile /home/domain/.htpasswd
AuthGroupFile /dev/null
AuthName "The Domain restricted Area"
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>
[download]