I think the number 4) should be fixed to make it consistant.
If you put anything in a protected directory, the security protection should not be bypassed, so, from an IP different from 123.123.123.123, none of the custom page should be accessible.
For 3), it should show the built-in 404 error...