Hi developers,
I noticed "Password Protection" feature is not real protection. Try to disable javascript in browser an you will see all photos.
I see only one way to implement real protection ( which would be working out of the box ). And that is generate different code for password protected page.
That would be nice to see it in the next version ;)
Current alternative is protect whole folder by .htpasswd ( google search: "htpasswd generator password" )