Deny Access to folder

Hi,
 
I have some pictures stored in a folder called "Pictures". I found out that also people, who are not registered users of my homepage, can see these pictures by typing www.example.com/Pictures/Example.jpg into their browser. But the pictures are private, so only people who have an account should be able to see them on my homepage with <img src="/Pictures/Example.jpg" />.
I have tried different things with the web.config file. I have a general web.config file in the root folder. Then I created an additional web.config file in the Pictures-folder. It had the following content:
 
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
 <location path="/Pictures">
  <system.webServer>
   <security>
    <authori ...