I've tried that, and I'm getting an error that the security settings have already been set. Does the answer change if survey.xxx.org is https and checkbox.xxx.org is not? It's as if the web.config for survey.xxx.org is also being processed.