Apache restrict access unless from localhost

The below code is in .htaccess file in /home/cuddle/test/

AuthUserFile "/home/cuddle/.htpasswds/test/passwd"
 AuthType Basic
 AuthName "Secure Area"
 Require valid-user
 

This works fine, it will prompt for username & password, however when I add another rule to allow internal requests:

Allow from 127.0.0.1
 Satisfy Any
 

It no longer prompts for password for outside users (non localhost) and seems to let all users through, no matter if they validate or what IP they are from. There are no other permissions/allow/deny present within .htaccess

---