How can I password protect the web.me.com/USER?
It appears that .htaccess files aren't supported, so someone came up with a javascript solution:

http://leonstafford.com/wp/encrypt-web-pages-on-mobileme.html

Here's some information on how it was possible to password protect the public folder in the mac.com implementation me.com, it may be relevant.

http://homepage.mac.com/rfwilmut/notes/faq.html#3_Public_Folder