OP> What am I missing to get PerlAutenHandler to read $r->notes or $r->headers_out->get??

Becouse they live only in the duration of the current request. you can not get the same infor across different requests.

You probably can use something like the following though:

my %auth;
sub handler {
    my $r = shift;

    my($res, $password) = $r->get_basic_auth_pw;
    return $res if $res != OK;

    my $user = $r->user;

    if (exists $auth{$user}){
        return Apache2::Const::OK;
    }
    ..... 
    $auth{$user} = $user;
    return Apache2::Const::OK;
}
1;
[download]

(untested)
Regards,
Xicheng