First off, I should note that form-based-authentication is only officially supported in Windchill starting at 10.1 M010 (and thus including 10.2). When configuring any form-based authentication in 10.1 M010 and higher, one should refer to the documentation on this topic in the Windchill help center.
Secondly, the appropriate way to disable Windchill authentication rules in Apache in such releases is via webAppConfig.xml and the disableAuthentication and protocolAuthOnly properties for the web apps in question. disableAuthentication disables all authentication constraints for the given web app (but leaves declarations of anonymously accessible resources/directories in place). protocolAuthOnly disables all authentication constraints for the given web app except for webAppName/protocolAuth/* URLs (and leaves the anonymous declarations as well) -- and is normally much more appropriate. In any cases these changes are most easily done by editing conf/extra/app-<webAppName>.properties files and then running "ant -f webAppConfig.xml regenAllWebApps" from the top-level Apache directory.
Note that in 10.2 the entire web app is configured to require "normal" end-user authentication with exceptions requiring anonymous access (and anonymous access must be allowed for those cases else functionality will break) and protocol-based (as opposed to form-based, for instance) authentication. By contrast, in 10.1 only the specific resources/directories within the web app that require authentication are authenticated. 10.1 and 10.2 were tested with these configurations, so requiring authentication on more of the web app in 10.1 may run into issues.
A more advanced usage would be to edit webAppAuthResToConf.xsl so as to modify the contents of the authentication block generated for each authenticated resource/directory, e.g. to generate some other directives than those for HTTP basic authentication. This is mostly of interest if one is trying to configure 10.1 with another form of Apache-based authentication and trying to require authentication only where it is required out-of-the-box.