It should work.
When you test the second URL, you should close all your browser window first, browser will remember the authentication when you test the first URL.
Is there a .htacess under /subdir/cgi/ folder? what is the content?
Also, you can switch back to Apache temporarily to verify your configuration see if it is working as you expected or not.