Open the Sharing tab for the folder. When you set it to Share This Folder, the Permissions button should become available. By default, "Everyone" is allowed to Change and Read files. You have to create a local username and password for each person who needs access to the files (or a single username/password that everyone shares), and when they try to connect to the folder over the network, they'll enter the password info. When you've created an account, you have to add the username to the list by typing the name into the "Enter object names to select" then the Check Names button. When it finds that user, add them to the list. You'll need to remove "Everyone" from the permissions list (or change it to only Read if you want them to just not be able to change files). You can also further restrict things on the Security tab.
XP does not have the same type of password protection that Win98 has. You either get "simple" sharing where everyone can see everything, or you get full NT-based permissions; no option to simply set a password and username for a particular folder.