Unauthorized roles still able to navigate to web page.

I have the following doe in my web.config

    <authentication mode="Forms">
      <forms loginUrl="Login.aspx" name=".ASPXFORMSAUTH" defaultUrl ="~/Manager/ManageContract.aspx">
      </forms>
    </authentication>
    <authorization>
      <deny users="?" />
    </authorization>
  </system.web>

    <location path="Manger/ManageContract.aspx">
    <system.web>
      <authorization>
        <deny users="*"/>
        <allow roles="Manager, Superuser"/>
      </authori ...