Remove the password from the web.config, because it is private data.
Turn configuration.debug to false.
Turn custom errors on.
Turn custom errors to remote only, because we want them locally.