I have created a Webapp with sensitive information that I would like to password protect. Is this at all possible? I know you can keep it private within your ESRI Organization but I would like to share it with non-esri users but restrict access from the general public.
If you don't mind paying, you can use the con terra security manager to control access to your services and data.
If you are familiar with programming you can implement simple reverse proxy. Your application can ask for user login and serve the webapp to loged in users. Here is a simple example(alhough it has an error, approach is correct) for .NET. I'm pretty sure that you may find similar approaches for other programming languages.
The way you're supposed to do this would be to create a new group for this item and add it to the group. Then, you invite the user you want to share the item with to the group. That way, they are not members of your organization and all they can see is what's shared with that group. The caveat is that this may not work for public accounts, only paid AGO accounts.
Host the data(services) on a server and require auth to those services. When the user tries to view the map they will need to ent appropriate credentials in order to view. You can add custom or generic login roles to the server as well.
ArcGIS for Server does this very well with most of the config ready to go out of the box.