Having RemoteUserAuthenticate after Authenticate does nothing - a request requiring a login was already redirected away before reaching the logic to load the user from the REMOTE_USER server setting. Moving RemoteUserAuthenticate before Authenticate fixes this.