Something is wrong with your .htpasswd file (as it is clear from the output that rest-server uses the correct path to it, /data/.htpasswd).
Verify, inside the container, that the file /data/.htpasswd really does exist and is non-empty, and of course also that it is readable.
If the file does not exist when the container starts, an empty one will be created. So you will probably find an empty /data/.htpasswd file inside the container, and presumably that your ./data/.htpasswd outside of the container still has its contents.
Another potential cause is that your ./data/.htpasswd file is not actually named like that, and has some misspelled name or something.
EDIT: It could perhaps also be that the environment variable PASSWORD_FILE contains something more than the file path, e.g. a space at the end (which would not show in the output), so you ought to check that too.
You were right, that .htpasswd file was empty. It is created by Ansible (I did not mention that), and first things I needed to do is to recreate this file, which I did not make.
When file is deleted and then again created, it is populated correctly, and the warning is gone.