Important!  You must configure your virtual directory to require SSL (https) or else your application will be fundamentally insecure. If you do not use SSL, client passwords and session cookies will be vulnerable to being stolen while in transit.