Security :: Web.Config Authorization Not Working At All?

I'm using a Custom Role Provider for authorization.

There are 2 roles: "VIEWER" and "SYSTEM_ADMINISTRATOR".

I have set up my role for my account as "VIEWER".

Roles.GetRolesForUser(this.User.Identity.Name) returns "VIEWER"
User.IsInRole("SYSTEM_ADMINISTRATOR") returns false

Web.Config contains below:

<location path="Administration">
<system.web>
<authorization>
<allow roles="SYSTEM_ADMINISTRATOR"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

However, I can still access the ~/Administration pages.

Even if I change the web.config to:

<location>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</location>

I can still access any of the pages, but I shouldn't be able to access any page when this is set. Correct?

I'm pretty sure my Role Manager is working fine (see above calls to User and Roles), but here's the config:

<roleManager enabled="true" defaultProvider="MyRoleProvider" >
<providers>
<clear/>
<add type="MyNamespace.MyRoleProvider" name="MyRoleProvider"/>
</providers>
</roleManager>

I'm testing this on my local dev environment using Cassini and on a test web server running IIS 6. Both systems/sites work the same way and allow anyone access to any page. Both systems/sites also return correct data when programmatically checking Roles.GetRolesForUser and User.IsInRole.