Yeah, like he said, stupid easy if all you want is to password protect it. If you step in a pile of IIS, it's just getting the right "right click->properties->permissions" combination. If you want to SSL it, you can also do that for free if you don't care about "This certificate is not from a valid..." errors every time you get a visitor.
Any of the bargain hosts will work.