i didn't change anything in IIS. to proof this, i set my web.config code back to use the original code:


<authorization>
<allow users="*" />
</authorization>

and now my sites...