I've just been trying to fight my way back into a site I'd not used for ages, where I couldn't recall the password and hadn't recorded it in my keepass database, so I asked for a password reminder and was then asked my security question - all good. However I found the answer was case sensitive. This nearly had me locked out for ever, and seems a bit over cautious to me.

Thanks Joe - I'll try to remember to add that to all our sites!

And on this note, is there any reference guide to every setting that can be used in web.config/user.config?  The details I've found so far are partial (http://www.mojoportal.com/webconfig.aspx), and there are a LOT of useful settings.