Oh. I thought you had a separate password on the subdirectories. It's not going to work like this at all--when I click the rate link the empty frame set loads, then I just get your password input screen and get kicked out.

Try moving the templates to an unprotected directory outside of admin ...they don't ACTUALLY have to be there, the script was just set up to look for them there.

Put them wherever you want, then change the path in links.cfg (just put the new full path instead):
$db_template_path = "$db_script_path/templates"; # PATH to templates.

This might fix the bad request error with rate.cgi--it might not. Have you made edits to the rate.cgi script itself? If so, maybe there's a typo or something. Anyway, if it still doesn't work try running from the command line to see if you get a more informative error then post again!