Oops.
This is category.php, my own theme.
I've also just woken up to the fact that my problem is because I've created a protected directory in which to do development, so this is an htaccess problem, though I've been searching for a few hours how to figure it all out.
The current htacces looks like this:
AuthType Basic
AuthName "blah"
AuthUserFile "/home/something/.htpasswds/public_html/blah/passwd"
require valid-user
I've added all sorts of stuff in front of it, to no avail e.g.
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} ^/secure/(.*)$
RewriteRule ^.*$ - [L]
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
I'm going round in circles now :-)