Passwords are a pain in the bazock.
Unless you can configure a server to protect an entire page, you have to go with some kind of JavaScript that's pretty easy to get past. Plus - once you do get past it, the password is no longer valid because you can just zip right to the page. This password script is solid in that it's within a PERL script so you can look at code and see the password. You must go through the password page. It's up to you if you want to put all of your protected pages within the cgi-bin or not.