But then won't everyone have to enter a username and password to see the image (even when it's produced by the cgi)? This doesn't seem to be what the OP wanted.
chas
(Update: My error; the answer is "no".)
I think you misunderstand the purpose of the .htaccess file - which is, simply put, to provide a per directory configuration. Please see the apache documentation if this is not clear.