Actually, we are both wrong.

I assumed that when creating an SSH tunnel all network traffic coming out of the tunnel would be viewed as being sourced locally. This isn't the case. All traffic is still viewed as coming from the external interface. Therefore, denying anything but local connections would mean we could not access squid at all. So adding "deny !localhost" completely shuts us off. You were correct when saying that the "allow password" was the key acl prompting us for a password and letting us in.

Thank you for pointing this out.. I will update the howto accordingly!