authentication help needed

i have 3 forms 
login.aspx
Mis.aspx
admin.aspx
all of them requires login how do i authenticate them so that the login user cannot view the mis.aspx page and admin.aspx page please help me out 
i have updated my webconfig as :
<authentication mode="Forms"> <forms loginUrl="~/login.aspx" name=".ASPXFORMSAUTH" timeout="5"> </forms>
</authentication>
<location path="loginuser.aspx"> <system.web> <authorization> <deny users="?"/> </authorization> </system.web></location> 
<location path="Reports.aspx">    <system.web>      <authorization>        <deny users="?"/>      </authorization>    </system.web>  </lo ...