The short answer: Because your users haven't logged in yet.
The long answer: Website Access Manager uses .htaccess files to password protect your website. The instructions in these files are read in order, and the first instruction is always going to be to ask for the username and password of any unauthenticated user. If the user doesn't have these credentials, they won't be able to access this portion of your website.
