As far as I know, the security of webserver (apache or nginx) password-protected folder is higher than that of $_SESSION defined access level. However, the common method (at least in CMS models) is to use the latter one instead of protecting the entire admin folder by webserver.
What are the pros and cons of using password-protected folder for administration of a CMS?
Pro Http Access
Pro Session