Oh, I've run into that with videos, rather than audio files. If you password-protect the album directory, the media player in the album can't access the video file. I'm not sure why that happens, but I've never found a way around it. I suspect it's the same kind of problem with audio files.
In Mr.Burn5, you could probably plant the audio in an unprotected directory on your server, and give the album the full path to it, like http://mydomain.com/media/mydog.mp3.
Where things get truly catastrophic, however, is on mobile devices. I won't bore you with the details. Suffice it to say that if you want mobile visitors to be able to see your videos or hear your audios, you'll have to stash them in an unprotected directory. Of course with videos, that pretty much defeats the purpose of password-protecting the album in the first place!
I was extremely annoyed by Safari's double-authentication requests. So, I immediately tested the same link with Firefox and Chromium, and found that they don't result in double authentication.
You are quite right about viewing a protected webpage with music in Safari on mobile devices. I was so annoyed by it that I almost gave up on the approach. Imagine sending a link to people with iPhones. They would most likely open it in Safari. I can literally imagine how annoyed they would be when they are asked TWICE to authenticate.
As you instructed, the album is still in a protected directory. But, after I moved the mp3 music file out of the album and put it in an unprotected directory, the movie sees to work fine in Safari on my iPhone.