Hi Carl,
If there exists a user.config file in the root, any <appSettings from there will trump what is in Web.config
In fact the user.config file is where you should put custom settings that override the default <appSettings from Web.config
That way when you upgrade it is easier to upgrade to the new Web.config file since most if not all of your custom settings can be in user.config.
Note that after you have created a custom machine key you do need to maintain that in Web.config during upgrades because it should not change. Only the <appSettings section can be used in user.config, nothing else from Web.config can be put there, but it does make it less work to maintain most custom settings by putting them in user.config
I suspect that these settings do exist in user.config and it has localhost so the settings in Web.config are not having any effect. The solution is to update the setting in user.config
Hope that helps,
Joe