Restricted Folder

I have a folder that holds aspx pages that does not display the pages unless the user is logged in.  I also have pdf files in that folder, but they can be accessed whether or not the user is logged in.  I want them restricted as well.  I have the following web.config in the folder:
<configuration>
   <system.web>
      <authorization>
         <deny users="?" />
      </authorization>
   </system.web>
</configuration>
 
What else do I need or is there a way to check if the user is logged in before executing the link?
...