Look at the authentication and authorization nodes of the web.config files. You can specify forms authentication as the main authentication mechanism. Then you set the whole site to be accessible to unauthenticated uses, then use "location" nodes to define the specific paths of the files you wish to restrict.
-Peter
compiledthoughts.com