The finished http_access section, according to this article, would be:

http_access allow localhost
http_access allow password
http_access deny all

This will NOT prompt for proxy authentication for SSH-tunneled connections - they come from localhost and will be allowed before authentication is used.

That first http_access line should be re-written:

http_access deny !localhost

The logic of Squid access controls is explained in the FAQ:

http://www.squid-cache.org/Doc/FAQ/FAQ-10.html