Fetch and configure:

 cd /usr/ports/www/apache2
 make fetch
 make configure WITH_SUEXEC=YES SUEXEC_USERDIR=. SUEXEC_DOCROOT=/

Patch suexec to remove gid checks (line 548)

Build:

 make

Stop Apache:

 apachectl stop

Install:

make deinstall reinstall

Restart apache:

 apachectl startssl

This needs to be fixed to work directly with the ports directory (shouldn't need the patch). One possibility is to force all cgi's into a cgi-bin dir instead of using .cgi in random places. Then webit could make the cgi-bin directory (and its contents) group-owned by the user (and suexec would be happy again).