I have a problem with a site I'm developing. If i put a mediadata-content (an image in this case) in the recycle bin, the image is still accessible for everyone. I want episerver to promt a login screen as it should.

I have looked on the "Set access rights" page and seen that Recycle bin had in fact read access for everyone. However this seems to be a default setting as I can see the same setting on the alloy tech site but the alloy tech site still prompts a login screen if I'm trying to access a trashed file.

What else determines the access rights to the recycle bin?