Hi Edd,
I’m not a server admin, so I would recommend working with your host to determine the best setup for your account. From what I understand, however, running PHP as CGI or FastCGI either one is incompatible with HTTP Auth for access to particular templates within EE.
Now hang on; this next part can get confusing…
Numbers 2 and 3 in your list behave that way for the similar reasons: unless you enable Multi Site Login on your MSM sites’ front-end login, you will only be logged-in to the site for which you submit the login form. For example, if you have a login form on site 1, that’s the site you’ll be logged-in to. Note that Multi Site Login is only available for logins on the front-end.
Now with that in mind, does it make sense why EE behaves like it does with question 3?
Further, even if you enable Multi Site Login, since it only applies to login forms on the front-end, if you login to the CP, you will only be logged-in to the front-end and the backend of the site that hosts the admin.php file for the CP. It won’t log you into other sites on your MSM installation. (Even though you can edit them through the CP, you technically aren’t logged into that particular site.) This is even Super Admins aren’t able to see your other MSM sites when they’re offline. In order to see site 2, they would need to be logged-in to site 2’s CP (through an admin.php file at site 2). I understand that’s not how you wanted to set your site up, and that’s totally fine.
While we’re aware that this is functionality that our users would love to have—and it’s indeed something we would like to provide—I’m not able to give any details for when that sort of a thing might be a reality.
Does that help clear things up for the login behavior confusion?