Having RemoteUserAuthenticate after Authenticate does nothing - a request requiring a login was already redirected away before reaching the logic to load the user from the REMOTE_USER server setting.
Moving RemoteUserAuthenticate before Authenticate fixes this.