I don't really understand the panic with your management over using basic authentication when done over HTTPS, it seems a bit overzealous to flag that as an immediate problem. (See https://security.stackexchange.com/questions/988/is-basic-auth-secure-if-done-over-https for a bit more discussion on the matter, yes I realize there are potential shortcomings but at least the password isn't going over cleartext here).
To add to Jenny D's good answer, the setup directory isn't needed if you do a manual configuration, isn't a means an attacker can use to exploit any known weaknesses, and isn't something users access anyway. It can be safely removed from the officially distributed phpMyAdmin files if you want by simple deleting that folder on disk or changing permissions to 000.
However, I also am unable to reproduce the situation you've described; in fact phpMyAdmin doesn't use any JavaScript for authentication prompts (there are four means of authenticating to phpMyAdmin; hard coding the username and password in the configuration file so that you're not prompted at all (auth_type config), an inline form for username and password (auth_type cookie), and asking your webserver to prompt you by means of http basic authentication, which actually may be what you mean but isn't JavaScript (auth_type http). You could try changing your auth_type to cookie if you don't like the http basic prompt, but I did a quick test here and the setup directory doesn't seem to be affected by the auth_type, so I am starting to suspect you've got an additional layer of security that's being provided by your webserver rather than phpMyAdmin itself.