Securing non-aspx files with IIS 7 issues

I've seen a lot of tutorials about getting IIS 7 to process non-aspx files and it makes it seem very simple, but I can't seem to get IIS 7 to force non-aspx files (pdf, rtf, etc) to cause authentication.  I'm using IIS 7 on Vista.  It seems simple enough--my defaultapppool is set to Integrated Pipeline and has my site associated with it. I added the following to my web.config <system.webServer>
<modules>
<remove name="FormsAuthenticationModule" />
        <add name="FormsAuthenticationModule" type="System.Web.Security.FormsAuthenticationModule" />
        <remove name="UrlAuthorization" />
        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
<remove name="DefaultAuthentication" />
  &n ...