.htaccess and .htpasswd authorisation

I'm trying to create a passworded directory on my website. My .htaccess file looks like this, and works:

RewriteEngine on

RewriteBase /

#this sends people coming to the root to the search page - lovely and invisibly
RewriteRule ^$ hidden/search.php [L,QSA]

AuthType Basic
AuthName "Search Admin"
AuthUserFile /path/to/my/file/.htpasswd
AuthGroupFile /dev/null
<Files hidden>
Require user valid-user
</Files>

All good.

However, I want this to block all traffic to the URL "hidden/*" if they can't provide a password. Looking at the Apache spec, Location or LocationMatch appear to have a syntax which means I can simply replace "Files" with one or other of them, and it will work. But when I do, I get a 500 server error...what gives?

Here's my code which generates the error:

RewriteEngine on

RewriteBase /

#this sends people coming to the root to the search page - lovely and invisibly
RewriteRule ^$ hidden/search.php [L,QSA]

AuthType Basic
AuthName "Search Admin"
AuthUserFile /path/to/my/file/.htpasswd
AuthGroupFile /dev/null
<Location hidden>
Require user valid-user
</Location>

Cheers!