I tried that, but no go... I think the deny="*" is preventing anything in that dir except the allowed roles...