What we do for private (limited use) sections of our portal is use IIS
security to deny access  to those folders based on IP addresses. In this way,
no one except those with approved IP addresses may access the limited use
folders and their contents. Then I create a custom error message telling
folks who attempt to open those folders why they can't when they try to do
that.

Unfortunately, I have to run  SSL and let people external come in --
that's why I have to do user  authentication. The authentication works
-- the problem I am seeing is that the web  portion will lock up rather
than return an error indicating that a user did not have rights  for
access.