Usually the reason for this is that you have password-protected a subdirectory on your site. In the same time in the webroot there is another .htaccess file with other Apache directives and this confuses the webserver to ask twice for the password.

In order to solve it either move the password protection to your webroot or remove any rewrite rules / redirections.