Ideas for password-protecting live site

I have set up a site where resin manages the authentication in the
usual way via a login box. I need to set up a staging server for the
testers to be able to see whats coming next, so it needs to be as
close to the live one as possible but only available to them. Hacking
it too much just to deny unauthorised access means it isn't ;-) What I
really want is the functionality I'd get by dropping a .htaccess file
in my root dir, running mod_caucho & apache, and having apache pop up
its password box once first, then the site appears as normal. I tried
this and apache just ignored it (because jsp's bypass it?). Anyway,
this and other ideas very welcome for what must be a common situation
please. Thanks.