user authorisation ?

Question

in my application if any user logs in he/she can access any page by enerting the page name in url,

i want to ristrict specific user from accessing page by typing in the url.

 

 

<location path="eg.aspx">
<system.web>
<authorization>
<allow users=" "/>

<deny users="*"/>
</authorization>

</system.web>
</location>

in "allow user" what have to be passed i have userid stored in session in every page, so can i put session value in allow user ?