apache2 directory protection

[vr <debian-user@iotk.net>]

I am having trouble getting apache2 recognizing directory protection.

I've created a directory /var/www/mydir and created .htaccess & .htpasswd
files in there but am never prompted for login.

.htaccess
AuthUserFile /var/www/mydir/.htpasswd
AuthType Basic
AuthName "test"
require valid-user

.htpasswd
mytestuser:<hashedScramble>

I understand that .htpasswd should reside someplace else and even moved it
to rule this out but is the above not enough on a default installation of
apache2 under lenny to protect a directory?