fixed web.config files for role-based security