simple config issue here.. i am stuck though -> the location directive..

i want to deny access to the contents of a specific folder in a php app to only specific IPs.
i read the nginx wiki and used:

location /foldername/ {
allow 127.0.0.1;
## drop rest of the world
deny all;
}

thinking that this would result in only the named IP having access to the folder and it's contents.
however, this has only blocked the root folder.. and not the contents.

this appears to contradict what is written on this page: http://wiki.nginx.org/HttpCoreModule

if i use instead:
location ^~ /foldername/

then the folder and contents is blocked.. however when i access a php file from within that folder (via an allowed IP address) i am presented with the option to download the php file instead of seeing the rendered output of the processed php file. i ensured that the location directive is at the end of the site config file, after the directives for php files that are passed to php-fpm.

so how do i set the config file to allow php files from specific directories to only be accessible to specific IP addresses?