.htaccess "Allow from env" disables SSLRequire - apache

Question

Using Apache, I force HTTPS on a folder:
SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "www.example.com"
ErrorDocument 403 https://www.example.com/admin/
and I protect the folder using Apache AuthBasic:
AuthType Basic
AuthName "Administration"
AuthUserFile /path/to/my/.htpasswd
Require valid-user
Satisfy all
Like this, the password is always sent over HTTPS. It works well, but then I tried to disable authentication for a single URL:
SetEnvIf Request_URI "crm/index\.php$" removeme_uri
Order deny,allow
Deny from all
Allow from env=removeme_uri
Satisfy any
This URL does not ask for authentication, and the others do. So all is well, but HTTPS is not required anymore, and the password can be sent in clear !
What am I doing wrong here ?

Answer 1

Thanks to Jon's answer, I could try different solutions. I found this question and applied the answer to my situation:
In the main directory, the .htaccess contains
SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "www.example.com"
ErrorDocument 403 https://www.example.com/admin/
AuthType Basic
AuthName "Administration"
AuthUserFile /path/to/my/.htpasswd
Require valid-user
Satisfy all
And in the crm subdirectory, the .htaccess has:
<FilesMatch "index\.php">
Allow from all
Satisfy any
</FilesMatch>
It forces the SSL in any case, and allows the access to crm/index.php.

Answer 2

This is kind of weird, because the Satisfy directive affects access restrictions, and eventhough the SSLRequireSSL and SSLRequire affect SSL, they're considered part of access restriction. So when you use Satisfy Any when allowing access to a URI to pass through without the need for valid-user, it also made it so the SSL access requirement is part of that Any. And since the options for Satisfy is either All or Any, you can't say "this one always, but these other 2 any".
You may have to use something like mod_rewrite to force SSL in your htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]