good catch, yeah it seems to work when I access the IP address directly from the server itself, now what do I do about that?

This happens is squid runs as a reverse proxy in front of apache. What you can do, is to contact the squid admin and tell him to add:
along the cache_peer directives.

Or you need to look better into the authentication through php.

Regards

I've written my own authentication through PHP using MySQL. I've used auto_prepend_file and auto_append_file to include my authentication on every html page, as well as putting a banner and menu on all the pages on the server. This works well for the html content, since content contributors don't have to include the standard code. If the contributed html is too complex. however, it doesn't work well. Long term, I need to go more toward a Content Management System, but that's a longer story.

I have the same concern as original poster; How do I use PHP authentication to limit access to non-HTML documents? I can use rewrite rules to change a request for other files to a php script, but I don't quite understand how to setup the headers and push the non-HTML (binary?) data.