Problem with Authorization for sensitive files within the site

Hi there,

 I'm trying to use web.config to secure files within my site, as they could potentially be used to do things such as adding/removing users.

 I need to lock out anyone other than the "Site Administrator" role from these pages.

I'm currently using location elements as below, which does seem to stop anonymous users from seeing the page but does not lock it down to just the Site Administrator role.:

<location path="sensitivePage.aspx">

  <system.web>

    <authorization>

      <deny users="?"/>

      <allow roles="Site Administrator"/>

    </authorization>

  </system.web>

</location>

 

I tried changing the ? to a * which then locked my Site Administrator role out as well.  ...