<filesmatch ".(css|eot|otf|ttc|ttf|woff|woff2)$">
    SetEnvIf Origin "^https?://[^/]*(domain).com$" ORIGIN=$0
    Header always set Access-Control-Allow-Origin %{ORIGIN}e env=ORIGIN
    Header always set Access-Control-Allow-Credentials "true"
    Header merge Vary Origin
</filesmatch>

SetEnvIf Host dev.domain.com dev
SetEnvIf Host staging.domain.com staging
AuthType Basic
AuthName "Password Required"
AuthUserFile /full/path/to/.htpasswd
Require valid-user
Order allow,deny
Allow from all
Deny from env=dev
Deny from env=staging
Satisfy any