How to show a feed that requires user/pass within a sidebar widget?

There is a solution as described here where you can put code at the top of wp-includes/feed-rss2.php to authenticate that the requester is a registered WordPress user. A better solution is to add it to your theme’s functions.php file:

function my_check_feed_auth() {
    if (!isset($_SERVER['PHP_AUTH_USER'])) {
        header('WWW-Authenticate: Basic realm="RSS Feeds"');
        header('HTTP/1.0 401 Unauthorized');
        echo 'Feeds from this site are private';
        exit;
    } else {
        if (is_wp_error(wp_authenticate($_SERVER['PHP_AUTH_USER'],$_SERVER['PHP_AUTH_PW']))) {
            header('WWW-Authenticate: Basic realm="RSS Feeds"');
            header('HTTP/1.0 401 Unauthorized');
            echo 'Username and password were not correct';
            exit;
        }
    }
}

add_action('do_feed_rss2', 'my_check_feed_auth', 1);
add_action('do_feed_atom', 'my_check_feed_auth', 1);
add_action('do_feed_rss', 'my_check_feed_auth', 1);
add_action('do_feed_rdf', 'my_check_feed_auth', 1);

This will require Basic Auth, which most RSS readers can configure, with the user’s WordPress login information. You can add more feeds on to the end there with more add_action calls, if you want.