The setup: IIS 7.0, ASP.NET 2.0, both installed on Vista Business (developer workstation) Home directory (configured as a virtual directory under the Default Web Site): Default.aspx (only has a standard link to plans/default.aspx) Web.config (no identity impersonate directive, so should default to false...