I've only worked on public facing ecommerce sites, so if I'm understanding correctly, this is probably beyond my area of experience. Are you using the "Password-Protect Entire Site" option on website setup?