This happens because of the .htaccess file with other Apache directives in webroot folder.
The Apache directives in .htaccess under webroot conflicts with rules of password protection, which leads to the problem.
In order to fix it you can set the password protection on webroot or you can remove the rewrite rules.