Ok, after looking thru my web.config and comparing it to the deployment version I had some inconsistencies.  I'm using the web.config file from the zip file for .Net4.  But to get the uploads to work here is what I had to change.

  <location allowOverride="true">

  </location>

  <!--
example protecting a folder by roles
for static files also requires the <modules runAllManagedModulesForAllRequests="true"> in system.webserver section
<location path ="Data/Sites/1/media">
<system.web >
<authorization>
<allow roles="Authenticated Users" />
<deny users =""/>
</authorization>
</system.web>
</location>