I know someone that was recently pulling his hair out over this... If I remember correctly you simply can't with basic htaccess password protection.. I think what he ended up doing was a real hack where he redirected them to
http://noone:[email protected] or something like that. I think he found the info searching on google.