Best password protection?

I need to password protect my galleries. I also need to have it so the photographer can easily create a folder, upload pics, and make a username and password for that folder. What is the best way to do this.

XML is no good because people can just pull that up, right?

.txt files you think would be as bad as .txt but apparently browsers can’t read .txt, so maybe it’s good?

I don’t think .htaccess is the way to go because I don’t want the person messing that up.

Anything else?

Thanks everyone.