.htaccess Auth Exceptions by URL CSS-Tricks has a useful snippet showing how to make exceptions to .htaccess password protection based on the requested URL.