If I were to do a payment plugin like that, I would put the files of the payment plugin in plugins/hikashoppayment, along with the other files of the plugin. That way, we could package it and have it installed with the files already in place. That would alleviate the setup burden for the user.
Why do you need a password protected folder for the call back ? If you do so, does that mean that your payment gateway is able to call callback urls like that:
http://user:password@website.com/myfile.php ?
I've never seen that for a payment gateway. Usually, most of them use a hash mechanism in order to be sure that the data sent from your website is valid on their end and vice versa.