感谢@thomas-löffler指出这一点。
原来apache配置有问题。

AllowOverride All
       Order deny,allow
       Allow from all

别忘了之后重启apache。

$sudo vi /etc/apache2/httpd.conf

....
DocumentRoot "/Users/imac/ROOT/WebRoot"
<Directory "/Users/imac/ROOT/WebRoot">
    #   
    # Possible values for the Options directive are "None", "All",
    # or any combination of: 
    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
    #   
    # Note that "MultiViews" must be named *explicitly* --- "Options All"
    # doesn't give it to you.
    #   
    # The Options directive is both complicated and important.  Please see 
    # http://httpd.apache.org/docs/2.4/mod/core.html#options
    # for more information.
    #   
    Options FollowSymLinks Multiviews
    MultiviewsMatch Any 

    #   
    # AllowOverride controls what directives may be placed in .htaccess files.
    # It can be "All", "None", or any combination of the keywords:
    #   AllowOverride FileInfo AuthConfig Limit
    #   
    #AllowOverride None
       
    AllowOverride All 
       Order deny,allow
       Allow from all 

    #   
    # Controls who can get stuff from this server.
    #
    Require all granted
</Directory>
......