Okay after doing a bit of Googling it seems that there is a problem with using password protected directories and having mod_rewrite rules in the root .htaccess file - which is why (I presume) that when SSU is turned off the root .htaccess isn't used and password authentication works?

Any .htaccess guru's know how I can get a password protected directory to work with the SSU .htaccess file?