If you would like to deny access to a UserControl, you will find that it cannot. You cannot specify certain characters including the ? in the <location path="">
As it happens, my current project's code, included a MasterPage: Page and a MasterUserControl : UserControl
Basically I derive all my Pages and UserControls from these, as they contain some general code that I want to apply to all.
The MasterPage looks at Request["View"] to get the UserControl to load. So typically I have one main aspx page.
Within this framework, I needed UserControls that are Public and those that are secure with Forms Authentication.
To do this, I created this code:
Those UserControls that I wish to be Secure behind the Forms Authentication, I derive them from SecureUserControl.
In order to inform the Authentication methods the URL I was intended to go to before redirecting to the login is specified in the RETURNURL section of the querystring.