Check out mod_bandwidth and mod_throttle. Both compiles right into Apache and you can control it on a per user basis, if you so desire. Has a nice status to see every users and how much they are running at what times.
Both are FREE.
Mod Throttle
Mod Bandwidth
For the password protection, I would recommend Iprotect from digital-concepts.net. Good coder and his stuff compiles into Apache as well.
The license is $500 for unlimited domains and up to 3 servers.
Iprotect