Positive/negative rules for visitors

Hi everybody,

I'm wondering about this problem.
Consider I have Page 1, 2 and 3 and want to allow strangers only to view page 1 (and correspondingly only menu item 1).

I put in positive of visitor access level only the menu item 1 and page 1, but if I log in with a superior level and then copy and paste the address of the page (say 2 or 3) without logging-in I can use the pages freely (something I shouldn't be allowed to do).

So enabling only page 1 doesn't stop from seeing page 2 and 3 if I know the page address. If I put all pages except page 1 in the negative rules, all seems to be fine (but here comes another question: how can I change the 50 pages limit to list all the pages i have?)?

Am I doing it right? (I have read the manual and thougth using positive rules should be enough for preventing unautorized page access).