Don't use 'needpass' since it doesn't automatically get set when a password is required, at least in pball. What you may want to try doing in this case is add the line 'set needpass "1" s' to your server config, and that monitor script should be able to pick it up.
If that's all that it takes to get server browsers to show the little padlock beside the server, I'll probably hack something into the engine code and maybe commit it for B20.