title: IIS Express is automatically disabling anonymous authentication for my project, why?
body: <p>When I switch my ASP.NET MVC project from Cassini web server to IIS Express, this is added to my <code>applicationhost.config</code> file:</p>
  
  <pre><code>&lt;location path="MyProject"&gt;
      &lt;system.webServer&gt;
          &lt;security&gt;
              &lt;authentication&gt;
                  &lt;anonymousAuthentication enabled="false" /&gt;
                  &lt;windowsAuthentication enabled="false" /&gt;
              &lt;/authentication&gt;
          &lt;/security&gt;
      &lt;/system.webServer&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>It's causing the site not to load with 401.2 - Unauthorized and I can't fix it on the Web.config level - it will then complain that the section is locked at parent level (HTTP 500.19).</p>
  
  <p>I can fix it by amending the <code>applicationhost.config</code> file but I don't understand why I should need to when no such section is added for a vanilla ASP.NET MVC project. What can be wrong?</p>
  
  <p>I'm using VS 11 beta but also confirmed this weird behavior in 2010 SP1. IIS Express says it's version 7.5.</p>