Protect wp-login, but get an internal server error

You might have edited your .htaccess file in Windows notepad or text editor.
If you did use Windows text editor then it must have added some special chars in .htaccess file and that will lead to 500 internal server error. Never edit in Windows text editor.

Use notepad++ for editing .htaccess and .htpasswd files.