IIS7 Authorization rules with custom role provider not working - asp.net

Question

Can someone please tell me why my IIS subdirectory authorization rules are not working?
I suspect it's something to do with using a custom membership and role provider.
All users, anonymous AND users who are logged in get a 401.2 Unauthorized error for all files in the /users subdirectory.
I'm trying to restrict access to static files and asp.net pages in a subdirectory. I used the Authorization Rules button in IIS7 manager.
In /users it has created a web.config file with this section:
<system.webServer>
<security>
<authorization>
<remove users="*" roles="" verbs="" />
<add accessType="Deny" users="?" />
<add accessType="Allow" roles="auth_users" />
</authorization>
</security>
</system.webServer>
In the web.config of the site root are these custom role and membership settings. The membership and role providers are working fine - user are added to the role, it's just the authorization rules that aren't working.
<roleManager enabled="true" defaultProvider="MyRoleProvider">
<providers>
<remove name="AspNetSqlRoleProvider" />
<add name="MyRoleProvider" type="System.Web.Security.SqlRoleProvider" applicationName="MyUsersApp" />
</providers>
</roleManager>
<membership defaultProvider="MyMembershipProvider">
<providers>
<remove name="AspNetSqlMembershipProvider" />
<add name="MyMembershipProvider" type="System.Web.Security.SqlMembershipProvider" applicationName="MyUsersApp" />
</providers>
</membership>

Answer 1

Still playing with this, it looks promising.. but I'm thinking there's probably a more elegant solution out there.
<location path="users">
<system.web>
<authorization>
<allow roles="auth_users" />
<deny users="*" />
</authorization>
</system.web>
<system.webServer>
<handlers>
<add name="HTML" path="*.html" verb="GET, HEAD, POST, DEBUG" type="System.Web.StaticFileHandler" />
<add name="JS" path="*.js" verb="GET, HEAD, POST, DEBUG" type="System.Web.StaticFileHandler" />
<!--More static file types...-->
</handlers>
</system.webServer>
</location>