Form Authentication does not work properly

See more:

C#

ASP.NET

I have one website, i have used login control, in web.config file followig code snipet is there.

<location path="data"></location>
    <system.web>.....

<authentication mode="Forms" >
        <forms defaultUrl="Default.aspx" protection="All" cookieless="UseCookies" name="webaite1" loginUrl="~/login.aspx" path="/"></forms>
      </authentication>
        <compilation debug="false" strict="false" explicit="true" targetFramework="4.0" />
    </system.web>

I have one folder name data, within which i have a marks.aspx and a web.config file. This web.config file has code snipet as follows:

<configuration>
  <location path="data" ></location>
    <system.web>
      <authorization >
        <deny users="five"/>
      </authorization>
    </system.web>
</configuration>

You can see user five is denied to see this page.
Problem is that if any one is accessing this mark.aspx page directly then page is accessed without letting the user to login.
I want that if some one trying to access secure page directly then also he should login, login.aspx should appears first.