Apache 2.4 seems to mixed all : IP denying and user denying are not working independent anymore..
In older versions I am able to enable the two things, and work with it without one affecting the other, for example:
deny from all allow from ip1 allow from ip2
In apache2.4 the equivalent is:
require ip1 require ip2
Until this point, all is good.
But when you have htacess+htpasswd in your website, the behavior is not as you expected because it thinks that the required ips are trusted to enter without password, anulating the htacess, and even worst, ips out of the desired list are able thanks to htacess to try to login with a password and that is not what apache 2.2 do!
In the ancient apache the hosts on allow from are the only that can try to authenticate... and even if they are allowed, it still will need a password from htaccess to open the website.
I am able to workaround the behavior using the mod_acess_compat for now... but i think this is not a solution, as i am using the ancient commands on the apache 2.4... and i am afraid about some unexpected behavior or the deprecation of this module...