The patch for 1067690 looks like it would conflict with
the patch to actually make the front-end Apache
authentication succeed.  Hm... Now that patch seems to
have never actually gotten applied (although I'm in the
acknowledgements, so I assume the patch was seen...) 
There also appears to have been something nasty with
the SF bug tracker, since there are no bug reports from
June through October.