<configuration>
<system.web>
<compilation debug="true"/>
      <authentication mode="Forms">
        <forms name=".ASPXUSERDEMO1" loginUrl="ch11/11-5/cs/login.aspx" protection="All" timeout="60" >
        <credentials passwordFormat="Clear">
            <user name="john" password="john" />
            <user name="tiff" password="tiff" />
            <user name="cola" password="cola" />
        </credentials>
	</forms>
      </authentication>
    <authorization>
 <deny users="?" />
 <deny users="tiff" />
<allow users="john;cola" />
    </authorization>
</system.web>
</configuration>