I'm sure you figured this out, but this is the first time I ran into this problem and I didn't find the answer posted anywhere so I thought I would post it here. For some reason when creating a new site (or even on the default site) there is an authorization rule set on the site root automatically...