I have a directory ("files") where sub-directories and files are going to be created and stored over time. The directories also need to deliver a directory listing, using "options indexes", but only if a user is authenticated, and authorized. I have that part built, and working, by doing the following:

<Directory /var/www/html/files>
  Options Indexes
  IndexOptions FancyIndexing SuppressHTMLPreamble
  HeaderName /includes/autoindex/auth.php
</Directory>

Now I need to take care of file delivery. To force authentication for files, I have built the following:

RewriteCond %{REQUEST_URI} -f
RewriteRule /files/(.*) /auth.php

I also tried:

RewriteCond %{REQUEST_URI} !-d
RewriteRule /files/(.*) /auth.php

Both directives are redirecting to auth.php when I request:

foo.com/files/bar/
foo.com/files/bar/baz

I am outputting the SERVER global on auth.php during testing and it is showing the requests as I made them (I thought Apache may have been doing something behind the scenes by adding something like "index.html" to the end with "Options Indexes" being on).

Ideas?