Protecting a sub-set of a public resource?

Okay, let's say I have a web server front-ended by iChain:

www.something.com/something

The resource in the ISO is defined as:

http://www.something.com/something/*
Public

Now, let's say I have a sub-page of that that I want to be restricted
(ie, you have to login to get/see it).

I added a resource as:

http://www.something.com/something/Protected/*
Restricted

Updated iChain.

But for some reason it never asks me to login when I access the page for
the /something/Protected

I always thought that the most specific match was used?

I know the converse is true (ie: "overall" one is restricted, and sub-
pages are public).