web.config in subdirectory

I'm using an additional web.config file in a subdirectory.  I'm doing this so users of the web app can't access the pages within the directory unless they are logged in.

The problem I am having is when I log out using the FormsAuthentication class I can still access the directory.   How do I, after logout, keep a user from access the subdirectory?

Here is the code that I'm using....

Parent directory web.config
<authentication mode="Forms">
<forms
loginUrl="login.aspx"
protection="All"
timeout="30"
name=".ASPXAUTH"
path="/"
requireSSL="false"
slidingExpiration="true"
defaultUrl="default.aspx"
cookieless="UseDeviceProfile"
enableCrossAppRedirects="false" />
</authentication>
<authorization>
<allow users="*"/>< ...