Why a password-protected directory asks twice for the password?
Usually, the reason for this is that you have a password-protected subdirectory on your site. In the same time in the webroot, there is another .htaccess file with other Apache directives and this confuses the web server to ask twice for the password.
To solve it either move the password protection to a different directory or remove any rewrite rules/redirection in the .htaccess file.