Did you set the authorization tag in web.config to private? or just public?

- kgc