It is off, but still says the same thing. here is my web.config:
<?xml version="1.0"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
<location path="events_edit.aspx" >
<system.web>
<authorization >
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
<location path="locations_edit.aspx" >
<system.web>
<authorization >
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
<location path="news_edit.aspx" >
<system.web>
<authorization >
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
<location path="photoalbum_new.aspx" >
<system.web>
<authorization >
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
<location path="member_list.aspx" >
<system.web>
<authorization >
<deny users="?" />
</authorization>
</system.web>
</location>
<location path="member_details.aspx" >
<system.web>
<authorization >
<deny users="?"/>
</authorization>
</system.web>
</location>
<connectionStrings>
<add name="ClubSiteDB" connectionString="Data Source=.\SQLExpress;Integrated Security=true;AttachDBFileName=|DataDirectory|clubsite.mdf;User Instance=True" providerName="System.Data.SqlClient"/>
<remove name="LocalSqlServer" />
<add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient" />
</connectionStrings>
<appSettings>
<!--
The <appSettings> section is used to configure application-specific configuration
settings. These can be fetched from within apps by calling the
"ConfigurationSettings.AppSettings(key)" property:
<add key="connectionstring" value="server=localhost;trusted_connection=true;database=pubs"/>
-->
</appSettings>
<system.web>
<!--
DYNAMIC DEBUG COMPILATION
Set compilation debug="true" to insert debugging symbols (.pdb information)
into the compiled page. Because this creates a larger file that executes
more slowly, you should set this value to true only when debugging and to
false at all other times. For more information, refer to the documentation about
debugging ASP.NET files.
-->
<roleManager enabled="true"/>
<authentication mode="Forms"/>
<compilation debug="false" strict="true">
<assemblies>
<add assembly="System.Xml, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
<add assembly="System.Messaging, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
<add assembly="System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
</assemblies>
</compilation>
<membership defaultProvider="AspNetSqlMembershipProvider" />
<siteMap defaultProvider="AspNetXmlSiteMapProvider" enabled="true">
<providers>
<remove name="AspNetXmlSiteMapProvider" />
<add name="AspNetXmlSiteMapProvider"
description="SiteMap provider which reads in .sitemap XML files."
type="System.Web.XmlSiteMapProvider"
securityTrimmingEnabled="true"
siteMapFile="Web.sitemap" />
</
providers>
</
siteMap>
<!--
The <sessionState> section is used to configure session state for the application.
It supports four modes: "Off", "InProc", "StateServer", and "SqlServer". The
later two modes enable session state to be stored off the web server machine -
allowing failure redundancy and web farm session state scenarios.
<sessionState mode="InProc"
stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;trusted_connection=true"
cookieless="false"
timeout="20" />
-->
<!--
The <customErrors> section enables configuration of what to do if/when an
unhandled error occurs during the execution of a request. Specifically, it
enables developers to configure html error pages to be displayed in place of
a error stack trace:
-->
<
customErrors mode="Off" />
<!--
The <authentication> section enables configuration of the security authentication
mode used by ASP.NET to identify an incoming user. It supports a "mode"
attribute with four valid values: "Windows", "Forms", "Passport" and "None".
The <forms> section is a sub-section of the <authentication> section,
and supports configuring the authentication values used when Forms
authentication is enabled above:
<authentication mode="Windows">
<forms name=".ASPXAUTH"
loginUrl="login.aspx"
protection="Validation"
timeout="999999" />
</authentication>
-->
<!--
The <authorization> section enables developers/administrators to configure
whether a user or role has access to a particular page or resource. This is
accomplished by adding "<allow>" and "<deny>" sub-tags beneath the <authorization>
section - specifically detailing the users/roles allowed or denied access.
Note: The "?" character indicates "anonymous" users (ie: non authenticated users).
The "*" character indicates "all" users.
<authorization>
<allow users="joeuser" />
<allow roles="Admins" />
<deny users="*" />
</authorization>
-->
<!--
GLOBALIZATION
This section sets the globalization settings of the application.
-->
<
globalization requestEncoding="utf-8" responseEncoding="utf-8"/>
</
system.web>
</
configuration>