authorization to deny access pages under a folder not working

 Hallo everybody,
I am developing a web application where .aspx pages under User folder needs to be athenticated. When a user requests for those pages  he will be redirected to login page and after login will be returned to the requested page. I have this in web.config file, under system.web tag
<authentication mode="Forms">
            <forms loginUrl="Public/Login.aspx" protection="All" slidingExpiration="false" defaultUrl="Public/Home.aspx"></forms>
        </authentication>
 
and then after end of system.web tag

<location path="User">
        <system.web>
            <authorization>
                ...