I had exactly the same problem as you.
This is how I resolved it:
conf/tomcat-users.xml (stays the same)
<tomcat-users>
<role rolename="admin-gui"/>
<role rolename="manager-gui"/>
<user username="admin" password="password" roles="admin-gui,manager-gui"/>
</tomcat-users>
Under conf/Catalina/localhost I needed an additional file for each context:
manager.xml
<Context privileged="true" antiResourceLocking="false" docBase="${catalina.home}/webapps/manager">
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="^.*$" />
</Context>
host-manager.xml
<Context privileged="true" antiResourceLocking="false" docBase="${catalina.home}/webapps/host-manager">
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="^.*$" />
</Context>
After that I was prompted for username and password and it worked.
I read some articles suggesting to edit the valves in /webapps/manager/META-INF/context.xml and /webapps/host-manager/META-INF/context.xml but I think the localhost one above takes precedence.