Handler to protect files in private folder isn't working

Hi all,
I have a supposedly private folder in my website which files (pdfs) are still accessible to everybody from the url.
I want to restrict access to these files to everybody, and I believe to do so I need to map the pdf extension to isapi so ASP.NET can take care of the security as specified in the web.config file
 <?xml version="1.0"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
    <system.web>
        <authorization>
      <deny users="?" />    OR         <deny users="*" />
    </authorization>
    </system.web>
</configuration>


To do this I have added this handler to my web.config file

        ...