So from the point of view of your website Facebook is just like any other visitor. Either the content is hidden for everyone or it isn’t for everyone.
Even if you’d try to detect Facebook and show them something different this punches a huge hole into your password-protection and makes it pretty much pointless as it is quite trivial for any random visitor to appear as if they where Facebook.