The protected directory is underneath the root of the web server (Apache 2.x) but two directories up from the root of the actual website itself - which is in a sub-dirrectory of the main site.
Could you elaborate a bit? What is the DocumentRoot of the website and what is the DocumentRoot of the main site?
You should know that .htaccess is used recursively for any subdirectory underneath the one it's placed. You should also take a look at the apache error_log for more info on the error.