we're trying to set up some files to be streamed from our apache server, but we want to authenticate with a user/pass before allowing the user to download. i know .htaccess can do it, but i've heard thats not always the best practice. i was looking into active directories, but i dont know much about it. what would you recommend?