Files still accessible despite "deny users" rule

Hi all,
I have a website with certain pages public and most secured with forms authentication:
        <authentication mode="Forms">
            <forms name=".mysite" loginUrl="~/Login.aspx" defaultUrl="~/Default.aspx" cookieless="UseCookies" domain="" timeout="10" protection="All" requireSSL="false" />
       </authentication> 
I have one particular folder with documents which I want to keep inaccessible to everybody. Files in this folder shouldn't be directly accessible from url (the website pushes this files
out from an aspx page after certain security check ups. I have the following web.config file in the folder above the folder where i keep this files:
root
   folder1
   folder2
   priv ...