Using securesite to block other (manually installed) website areas

I am responsible for my company's engineering intranet, which we used to have blocked by a generic http auth login (everyone just used the same "account"). Recently we refurbished the site and added drupal for the main site. We have several other applications running on the site, including bugzilla and dotProject. For these apps, I added a block with links to each of these tools, and made it not show up unless you've got the appropriate role marked. For now, we don't care about integration, they've got to log into each application separtely.

Now with drupal everyone has their own logins, which increases accountablity. That's great since eventually we'll open up access to the site for the entire company instead of just limiting it to engineering, and different departments will have access to different content. But of course that killed the http auth security...

I just installed the securesite module in order to get the http auth security back, and that works great. But, if the user directly types in http://server/dotproject/ he can bypass the http auth security and get to the dotproject page (a login page if they're not logged in). How do I get the http auth to work over the entire site, especially non-drupal related directories?

Thanks,
- Steve