I'm betting it has something to do with the load balancing setup we're using - the IP's the server actually sees aren't yours, so the Order Deny,Allow stuff won't work (the problem is the IP the actual servers see ends up being the one from the load balancer).
What's puzzling is the password one - that should work and I've actually seen it in use on other users hosting accounts, so that's a peculiar one for sure...
Edit: Just checked password protecting a directory and that seems to be working on free, although there is one difference that might've made a difference: I don't have wordpress installed on my demo account. If WP has some weird stuff in its .htaccess (which I know from my paid account it does) that -might- be throwing off the password stuff. So now it's a -real- challenge - we know it actually works but something's causing it not to :S
Sorry I didn't have an actual solution but it's worth at least starting with that it does work on a blank .htaccess, at least that's a start...