I commented the default settings line out.  I replaced the line with the line from my backed-up web.config.

Now I can log in as superuser and admin and all registrations are collected in the same place.

To be fair, it does mention this in the Readme.txt, but it is casually written and doesn't look like it definitely must be done. It uses the word Localized.  That misled me. I haven't custom-localized my portal, so I didn't know I had to do this <machineKey> setting.

It doesn't explain what will happen if you don't do it.  (You lock out Admin and Host, and any registrations made during this state will be subsequently lost). Obviously, knowing this would have helped pin down the error very quickly.

Here's the readme.txt bit:-

"-merge any localized settings from your old web.config to the new web.config. These typically include:
  - connection strings ( SiteSqlServer )
  - machine keys ( validationKey and decryptionKey )
  - objectQualifier

My comments are:

The Web.Config supplied should be self-documenting.  One needs to put in comments to mark the places you customise it.

Upgrades should be a standard procedure and upgraders need to have the process description and timescales expected in order to plan the work.  When you are upgrading, you may well be working in the live, with all the users waiting.

This web.config file is pretty terrifying. There is a crying need for a decent configuration utility.

Even for seasoned programmers, it is awkward.  It now is a 10-page xml document.

Cheers

David