Login page going round and round

Hello,
I am doing the WebMatrix walk throughs but I'm currently stuck on this one "Build an End-to-End Application (with VB.NET)"

When I run it I see the Login.aspx page and if I enter a correct username + password combo I just get sent back to a fresh login.aspx page again.
If I remove web.config I get sent through to the Default.aspx
So I assume that the problem is in the web.config file but I haven't a clue!
I have added the web.config code below so can anyone see a fault here? something missing maybe?

Thank you,

Ray.

<?xml version="1.0" encoding="UTF-8" ?
<configuration
 <!--
 The <appSettings> section is used to configure application-specific configuration
 settings. These can be fetched from within apps by calling the
 "ConfigurationSettings.AppSettings(key)" method:
 <appSettings>
 <add key="connectionstring" value="server=localhost;trusted_connection=true;database=pubs"/>
 </appSettings
 --
 <system.web
 <!--
 The <sessionState" section is used to configure session state for the application.
 It supports four modes: "Off", "InProc", "StateServer", and "SqlServer". The
 later two modes enable session state to be stored off the web server machine -
 allowing failure redundancy and web farm session state scenarios.
 <sessionState mode="InProc"
 stateConnectionString="tcpip=127.0.0.1:42424"
 sqlConnectionString="data source=127.0.0.1;trusted_connection=true"
 cookieless="false"
 timeout="20" /
 --
 <!--
 The <customErrors> section enables configuration of what to do if/when an
 unhandled error occurs during the execution of a request. Specifically, it
 enables developers to configure html error pages to be displayed in place of
 a error stack trace:
 <customErrors mode="RemoteOnly" defaultRedirect="GenericErrorPage.htm">
 <error statusCode="403" redirect="NoAccess.htm"/>
 <error statusCode="404" redirect="FileNotFound.htm"/>
 <customErrors
 --
 <!--
 The <authentication> section enables configuration of the security authentication
 mode used by ASP.NET to identify an incoming user. It supports a "mode"
 attribute with four valid values: "Windows", "Forms", "Passport" and "None":
 The <forms> section is a sub-section of the <authentication> section,
 and supports configuring the authentication values used when Forms
 authentication is enabled above:
 --
 <authentication mode="Forms"
 <forms name=".ASPXAUTH"
 loginUrl="login.aspx"
 protection="Validation"
 timeout="999999" /
 </authentication
 <!--
 The <authorization> section enables developers/administrators to configure
 whether a user or role has access to a particular page or resource. This is
 accomplished by adding "<allow>" and "<deny>" sub-tags beneath the <authorization>
 section - specifically detailing the users/roles allowed or denied access.
 Note: The "?" character indicates "anonymous" users (ie: non authenticated users).
 The "*" character indicates "all" users.
 -->
 <authorization>
 <deny users="?" />
 </authorization
 </system.web
 <location path="NewUser.aspx">
 <system.web>
 <authorization>
 <allow users="*" />
 </authorization>
 </system.web>
 </location
</configuration

Probably a good idea to add the login.aspx code too... I'm really busted on this one!

<%@. Page Language="VB" %>
<script runat="server"
 Sub LoginBtn_Click(Sender As Object, E As EventArgs)
 Dim userDS As New System.Data.DataSet
 userDS = GetUser(UserName.Text, UserPass.Text)
 If userDS.Tables(0).Rows.Count = 1 Then
 FormsAuthentication.RedirectFromLoginPage(UserName.Text, false)
 Else
 Msg.Text = "Invalid Credentials: Please try again or <a href='newuser.aspx'>register a new user</a>"
 End If
 End Sub
 Function GetUser(ByVal userName As String, ByVal userPassword As String) As System.Data.DataSet
 Dim connectionString As String = "server='(local)'; trusted_connection=true; database='MatrixOrders'"
 Dim dbConnection As System.Data.IDbConnection = New System.Data.SqlClient.SqlConnection(connectionString)
 Dim queryString As String = "SELECT [Users].* FROM [Users] WHERE (([Users].[UserName] = @.UserName) AND ([Users].[UserPassword] = @.UserPassword))"
 Dim dbCommand As System.Data.IDbCommand = New System.Data.SqlClient.SqlCommand
 dbCommand.CommandText = queryString
 dbCommand.Connection = dbConnection
 Dim dbParam_userName As System.Data.IDataParameter = New System.Data.SqlClient.SqlParameter
 dbParam_userName.ParameterName = "@.UserName"
 dbParam_userName.Value = userName
 dbParam_userName.DbType = System.Data.DbType.String
 dbCommand.Parameters.Add(dbParam_userName)
 Dim dbParam_userPassword As System.Data.IDataParameter = New System.Data.SqlClient.SqlParameter
 dbParam_userPassword.ParameterName = "@.UserPassword"
 dbParam_userPassword.Value = userPassword
 dbParam_userPassword.DbType = System.Data.DbType.String
 dbCommand.Parameters.Add(dbParam_userPassword)
 Dim dataAdapter As System.Data.IDbDataAdapter = New System.Data.SqlClient.SqlDataAdapter
 dataAdapter.SelectCommand = dbCommand
 Dim dataSet As System.Data.DataSet = New System.Data.DataSet
 dataAdapter.Fill(dataSet)
 Return dataSet
 End Function
</script>
<html>
<head>
</head>
<body style="FONT-FAMILY: arial">
 <form runat="server">
 <h2>Login Page
 </h2>
 <hr size="1" />
 <table>
 <tbody>
 <tr>
 <td>
 Username:</td>
 <td>
 <asp:TextBox id="UserName" runat="server"></asp:TextBox>
 </td>
 <td>
 <asp:RequiredFieldValidator id="RequiredFieldValidator1" runat="server" ErrorMessage="RequiredFieldValidator" ControlToValidate="UserName" EnableClientScript="False"></asp:RequiredFieldValidator>
 </td>
 </tr>
 <tr>
 <td>
 Password:</td>
 <td>
 <asp:TextBox id="UserPass" runat="server" TextMode="Password"></asp:TextBox>
 </td>
 <td>
 <asp:RequiredFieldValidator id="RequiredFieldValidator2" runat="server" ErrorMessage="RequiredFieldValidator" ControlToValidate="UserPass" EnableClientScript="False"></asp:RequiredFieldValidator>
 </td>
 </tr>
 </tbody>
 </table>
 <asp:button id="LoginBtn" onclick="LoginBtn_Click" runat="server" text="Login"></asp:button>
 <p>
 <asp:Label id="Msg" runat="server" forecolor="red"></asp:Label>
 </p>
 </form>
</body>
</html