Assign a particular username, or comma-delimited list of usernames, to the deny element
The ASP.NET Framework uses a first-match algorithm. If you switched the allow and deny rules, then no one, not event Jane, would be allowed to access the pages in the folder. File: SecretFiles\Web.Config