Yes. I can't find an example unfortunately, but it revolves around setting an environment variable when a querystring is matched, and then later checking for the presence of the variable and invoking the password protection.

However, you should actually consider rejigging your navigation or design so that anything that does have to be password protected goes into a specific folder. You may be making more work for yourself than is necessary by trying to tie password protection to querystrings, esp considering the limitations of basic HTTP auth (use a HTML login form perhaps, far more compatible with a querystring)

Oh, it was just "bplay" or something garbled. It could be some form of spam bot, which would be surprising if they've already sussed my measures.