I want to Password protect portions of a site

---Main site No Password
--thisFolder need password
--thisOtherFolder need different password.

Was going to put a child web.config in
--thisOtherFolder
--thisFolder

and change the cookie name for each folder

The diagram on page 650 would indicate that this is possible.

But everytime I try and use web.config in a folder other than root I get allowDefinition='MachineToApplication' beyond application level

Virtual Directorys are not an option here

Anyone have any other idea or Should I use the classic solution of setting a unique cookie key for each section?