I don't think this tries to protect any files on the web server; I think this authentication only keeps the CGI script from doing things that someone other than Bob ask it to do.
I believe the CGI script actually sends the 401 header.
When the Atom client responds, the meat of its response is in the X-WSSE header which Apache passes to the CGI script.