Password protection for some page

<authentication mode="Forms">
      <forms loginUrl="~/upload/Default.aspx">
      </forms>
    br mode="hold" />    <authorization>
      <deny users="?">
    br mode="hold" /></deny></authorization></authentication>

protected void Login1_Authenticate(object sender, System.Web.UI.WebControls.AuthenticateEventArgs e)
 {
     string username;
     string pwd;
     string CurrentUser = "";
     string CurrentPwd = "";
     bool LoginStatus = false;
     username = Login1.UserName;
     pwd = Login1.Password;
     XmlDocument xd = new XmlDocument();
     xd.Load(Server.MapPath("~/App_Data/AllUser.xml"));
     XmlNodeList xnl = xd.GetElementsByTagName("User");
     foreach (XmlNode xn in xnl)
     {
         XmlNodeList cxnl = xn.ChildNodes;
         foreach (XmlNode cxn in cxnl)
         {
             if (cxn.Name == "username")
             {
                 if (cxn.InnerText == username)
                 {
                     CurrentUser = username;
                 }
             }
             if (cxn.Name == "password")
             {
                 if (cxn.InnerText == pwd)
                 {
                     CurrentPwd = pwd;
                 }
             }
         }
         if ((CurrentUser != "") & (CurrentPwd != ""))
         {
             LoginStatus = true;
         }
     }
     if (LoginStatus == true)
     {
         Session["UserAuthentication"] = username;
        Session.Timeout = 1;
         FormsAuthentication.RedirectFromLoginPage(username, true);
     // Response.Redirect("upload.aspx");
     }
     else
     {
         Session["UserAuthentication"] = "";
     }
 }