Put a file named .htaccess in it containing this one line
Options +Indexes
You should be able to set up password protection via your host's control panel but that's where it gets a little tricky. The protection is done via a .htaccess file as well which is automatically written to the directory.
So it will overwrite the .htaccess file you've just created to allow directory listings. You can create your own password protection .htaccess file (google for instructions) and include both functions but IMO that's inferior to using the host's system since it will write the password file to a directory you can't access.
I suggest moving your files directory one level deeper, ie:
The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there was an error in a CGI script.