Access control, virtual hosts & aliases

I'm running a website on a hosted apache installation: I do not have
access to http.conf but do have permissive .htaccess.

I'd like to password protect my stats page, accessed as
www.example.com/stats/ Unfortunately, this is not a true directory,
rather it triggers some form of script and prevents me with the
results of http-analyze.

I'd like to password protect this page. As there's no directory
mapping to www.example.com/stats/ I can't drop an .htaccess file in
there.

I feel I'm missing something obvious. Any clues?

Giles