apache vs. passwordauth: done a bit more research