apache - .htaccess rewrite but exclude password-protected directory results in 404 error -

i have pretty url setup .htaccess rewrites non-existent urls (not strictly 404 errors) php script serves either content or 404 message. have excluded existing files , directories rewriting css, images, etc, won't affected.

however, there 1 directory password-protected .htpasswd should bypass rewrite rule not when .htpasswd enabled it.

parent directory .htaccess:

rewriteengine on  rewritebase / rewritecond %{request_filename} !-f rewritecond %{request_filename} !-d rewriterule . /callbacks.php [l] 

there's child directory following .htaccess:

rewriteengine on  options -indexes  authname "backstage access"  authtype basic  authuserfile /path/to/.htpasswd authgroupfile /dev/null  require valid-user 

if remove require valid-user line, parent directory's rewrite rule ignores child directory want, , can access browser. when turn on authorization, parent directory's .htaccess rewrites child directory /callbacks.php, resulting in custom 404 error.

any ideas on how fix this? cannot remove need password-protection. tried removing parent rewrite rule , instead using /callbacks.php 404 error document, post , data isn't transferred.

i'm not sure if still actual, had same problem , found fix - add htaccess following lines:

errordocument 401 /somepage.html errordocument 403 /somepage.html 

and should enough bypass rewriter