Same is true for lighttpd-mod-webdav; it's essential to keep the correct order, otherwise auth won't work as expected. From the documentation pages: "If you want to setup a WebDAV repository with authentication, make sure you are loading mod_webdav before mod_auth."