Yes, that's normal. That's what the .htaccess and .htpasswords files do.
This happens after you configure your GC setting and set the basic authentication for php running over CGI.

It's a good thing too, if you didn't have those set up, anyone would be able to access the files on your /googlecheckout folder.

The user name and password are your GC merchant ID and key.