I think I found a bug. At various places in the frontend component, it is accessed files of the administrator component. If the administrator folder is password protected by .htaccess, the user cannot use the frontend component. Please, can you check this.