If we put this in the web.config this means we support storing the "data" directory in the webroot under IIS and must ensure that this is secure :-(

Could anyone please check this? :-)