+1  A: 

after some more testing, according to what the link I posted said, it seems that this error is happening only when I run in debug mode from visual studio. If I set the project to run in IIS, the error is gone and the security implementation works as expected.

---Is that a bug in the lightweight webserver implemented in Visual studio then?---

Edit : You can go in the Properties of your web project, go to the "Web" tab, and check "Use local IIS Server". However, this will require you to run Visual Studio as an Administrator and to have IIS installed on your machine, so that VS can create the virtual directory in the local IIS server when it loads the project.

Stephane
+1  A: 

I've encountered the same problem and found a lot of useful info (and solutions) here.

bob
You can actually go in the properties of your web project, go to the Web tab, and check "Use local IIS Server" this will require to run Visual Studio as an Administrator so that VS can create the virtual directory when it loads the project, but it solves the issue.
Stephane
indeed, but it takes a little more time to get started, I try to achieve the 'get source and run' principle...
bob