Well, does your site support SSL ? By "basic http
authentication", you mean a password ? Can this password
by transfered using SSL ?
If you can add a password to protect this files and this
password can be sent using SSL and your web server is
well configured, I think you did the necessary job to
protect your files. If you are paranoic, you can also
encrypt your files in the webserver (each file
separately, not file system encryption)...

-DBC