auth_basic from if condition?

[Sergey]

I seem to have discovered that something that I thought was possible might
actually not be so. 

I have a scenario where I would like users from specific IP ranges to have to go
through the authentication procedure and others not to. 

I thought for sure this would work:
if ( $remote_addr != range ) {
   auth_basic "bla";
   auth_basic_user_file users.conf; 
} 

However, I'm discovering that if you do a test of this config that nginx does
not like the auth_basic directive in the if condition. Is this the correct
behaviour? Is there a way around it? Is there some way to emulate what I want?