restrict access problem

[lhmwzy]

I want to do a restrict access for URI contains xinxi,I do as follow:

    location ~ xinxi {
                allow 10.68.49.21;
                auth_basic "need authried";
                auth_basic_user_file passwd;
                deny all;
        }

when I access http://10.66.23.102/bxzx/xinxi/ from 10.68.49.210,nginx
says "403 Forbidden".
I think the rule checkorder is
first "allow 10.68.49.21;"
then " auth_basic "need authried";auth_basic_user_file passwd;"
last   "deny all"
So when I access http://10.66.23.102/bxzx/xinxi/ from
10.68.49.210,nginx should prompt me to input username and password.
Am I right?