Apache 2.2 problems to protect folder with mod_authz_host

Hello, We're having some trouble with upgrading our webserver from apache 2.0 to apache 2.2. Everything is working fine except one thing: We have created one alias (outside the web root folder). On this folder nobody from the internet should have access to it. Only the webserver should have access to this folder. On Apache 2.0 it was no problem to configure this in the httpd.conf. We loaded the module mod_access (which is now mod_authz_host) and created the alias: Alias /abc "c:/apache/xyz/" Options Indexes MultiViews ExecCGI DirectoryIndex index.php Order deny,allow Deny from all Allow from 127.0.0.1 But with this configuration it is possible to get access to our protected folder in Apache 2.2. Where is the error? Best regards. Dennis PS: I don't want to protect this folder with .htaccess, if anybody is asking.