password protect directories in IIS

This touches on it some. You put an accessType rule in the Web.config as suggested here, only it looks like:

<add accessType="Deny" users="?" />