Again replying to myself.... here is the explaination I got from my provider:
If Apache is compiled with the option -DSECURITY_HOLE_PASS_AUTHORIZATION, then
it will pass the User/Pass Auth data to a CGI application through the
HTTP_AUTHORIZATION header (eg, in FastCGI, -pass-header HTTP_AUTHORIZATION).
By Default, the User/Pass data is not passed with the HTTP_AUTHORIZATION
header.
Technically this is viewed as a potential security violation, but on our
system, all Authentication would be handled either by .htpasswd or internal PHP
Code (eg PHP controls it). No System User information is passed in the clear,
and hence its really not a security violation. On systems that utilize other
mod_auth modules, then perhaps it could be (eg , LDAP or PAM ), but in general,
these are special circumstances and generally not available in Shared hosting
environments.
.......
I hope that helps those that are having the same probs as me!
John ka0osk :)