If your .htaccess password-protected directories “above” a wordpress install are not working correctly, there is potentially a problem with the webserver searching for a 401 error document and not finding it, thus passing control on to the wordpress catchall RewriteRule.

Try adding in the following line BEFORE the #BEGIN WordPress line:

ErrorDocument 401 /401_error.html

After a few hours of frustration, I didn’t actually believe that this would work, but it did!