Problem with role and access rule: I can get in with any password

 Hi there,
 
I've got a web site with a protected folder that can be accessed only by specific users. I therefore creaed a role, PayingMembers, assign a couple of users to this role, then I created two access rulesl: after selecting the protected folder I allowed first access to the folder for role PayingMembers, then I denied access to All users (or even Anonymous) , being this rules at the bottom. When I try to log in, I cannot, even forcing access to a specific user, it doesn't let me in.
If I delete the Deny access rule to All users , it let everybody in. I also followed the step by step, same result. I always build the solution every change I make.
Have you got any idea guys? many thanks

...