Administrative page still accessible by anonymous users? It's almost 2 years I don't program modules in D7.
I'm creating a module that shows 2 forms.
One is public (and to's working) and one is a setup form under /admin space.
The issue is that the one in the admin still accessible to anonymous, even when I check the checkbox into the "permission" page.
Could you help me please to find out what I miss?

Please here part of the code

function MyModule_permission() {
  return array(
    'administer MyModule' =&gt; array(
      'title' =&gt; t('Administer MyModulemodule'),
      'description' =&gt; t('Perform administration tasks for MyModule module.')
    ),
  );
}


here below the address of the 2 forms

/**
 * Implements hook_menu().
 *
 * Displays module information.
 */
function MyModule_menu() {
  $items = array();

  // It should be accessible by everybody
  $items['fillin'] = array(
    'title' =&gt; 'Participation Data',
    'description' =&gt; 'Please fill here below the fields in',
    'page callback' =&gt; 'drupal_get_form',
    'page arguments' =&gt; array('MyModule_form'),
    'access callback' =&gt; TRUE
  );

  // it should be accessible only by admin
  $items['admin/config/setup_collection'] = array(
    'title' =&gt; 'Participation Text',
    'description' =&gt; 'Text for the presentation',
    'page callback' =&gt; 'drupal_get_form',
    'page arguments' =&gt; array('MyModule_setup_form'),
    'access arguments' =&gt; array('administer'),
    'type' =&gt; MENU_CALLBACK,
    'access callback' =&gt; TRUE
  );

  return $items;
}


Here below the setup form with the default content, that should be accessible only by the administrator

/**
 * Implement hook_form()
 *
 * Creates the form for the setup page
 *
 */
function MyModule_setup_form($form, &amp;$form_state) {
  $form['MyModule_message'] = array(
    '#type' =&gt; 'textarea',
    '#title' =&gt; t('TEXT '),
    '#wysiwyg' =&gt; TRUE,
    '#default_value' =&gt; variable_get('MyModule_message', 'Subscribe fill in the form below'),
  );

  $form['submit_button'] = array(
    '#type' =&gt; 'submit',
    '#value' =&gt; t('SUBMIT'),
  );
  return $form;
}


Here below just a part of the form accessible by the anonymous user

/**
 * Implements hook_form().
 *
 * Creates the form for the user.
 */
function MyModule_form($form, &amp;$form_state) {

  global $conf;

  $form['MyModule_main_message']['hello'] = array(
    '#markup' =&gt; variable_get('MyModule_message'),
  );

  $form['first_name'] = array(
    '#type' =&gt; 'textfield', 
    '#title' =&gt; t('Put your first name'),
    '#size' =&gt; 50,
    '#maxlength' =&gt; 50,
    '#required' =&gt; TRUE,  
  );

            ...
            ...
            ...
The problem is you are setting 
'access callback' =&gt; TRUE 
this gives access to all.
I also to sure that administer is a valid permission in 'access arguments' =&gt; array('administer'), instead try 'access arguments' =&gt; array('administer site configuration'),.