nothing locked: a child web.config can weaken any setting
