seems like you told Apache to require a password for your web-root, but did you dell Apache to not require it for all other directories?
Inside your .htaccess (or in httpd.conf, they do the same job) you likely have something like what is below (add a pastebin link to your .htaccess file and I can make this exact):
Allow from all
AuthName "Private Access"
But that will apply to all directories under that path as well. You'll need to explicitly tell Apache otherwise.
You can use regular expressions with
<DirectoryMatch "regex"> to generalize this, just don't forget to guard against
Also worth mentioning that although much of the documentation already has
<Directory[Match]> directives there are also
<Location[Match]> directives that are helpful in the case of symlinks on the underlying filesystem.