Hi Karl,
First: there is a typo, I belief:
"* Select either a user OR username and password (or both)."
should be:
"* Select either a user OR username and password (not both)."
Second, I was testing with "New Incognito Window", but only the first of such a session gives me the login-box. After closing the Incognito window en starting a new one, I do not have to login again but I'm seeing the protected folder immediately.
Changing user/password and starting another new Incognito window does not help either.
FOUND IT: when using Cloudflare you have to flush all pages after adding/changing users/passwords (and still use the Incognito window when testing).
Strange... isn't it?
Martin