I haven't messed with .htpasswd files in ages, but it should be pretty simple to add new people to the file on the fly. But if a user changes their password that might be a pain. Unless you dump out the whole userbase fresh on every change?

There is also something like mod_auth_dbm, for dbm files instead of text files. That could make it trivial to both add and update the .htpasswd dbm file on every new user and changed password.

Would something ugly like writing out a .htpasswd from scratch every time work all right? Can you see if you have mod_auth_dbm support? (I think it comes with apache and might be turned on by default.)

-Jonathan