Extending Asp.NET 2.0 (beta) security

<?xml version="1.0" encoding="utf-8" ?>
<siteMap>
    <siteMapNode url="Default.aspx" title="Home" description="This is the default page">
        <siteMapNode url="Webform1.aspx" title="Webform1"  description="">
            <siteMapNode url="Marketing/SecureFile.aspx" title="Secure File 1"  description="" roles="Marketing" />
        </siteMapNode>
        <siteMapNode url="" title="Marketing">
            <siteMapNode url="SecureFile.aspx" title="Secure File 2"  description="" roles="Marketing" />
        </siteMapNode>
        <siteMapNode url="" title="Links">
            <siteMapNode url="http://google.com" title="Google" description="Google" roles="" target="_blank" />
            <siteMapNode url="http://yahoo.com" title="Yahoo!" description="Yahoo!" roles="" target="_blank" />
            <siteMapNode url="http://microsoft.com" title="Microsoft" description="Microsoft" roles="" target="_blank" />
        </siteMapNode>
    </siteMapNode>
</siteMap>

    
<httpModules>
    <add name="SecurityHttpModule" type="Joel.Net.SecurityHttpModule" />
</httpModules>

    
using System;
using System.Web;
using System.Web.Security;

namespace Joel.Net {

    /// <summary>Security Http Module</summary>
    public class SecurityHttpModule : IHttpModule {

        #region Properties
        public bool IsReusable {
            get { return true; }
        }
        #endregion

        public SecurityHttpModule() { }

        /// <summary>Initializes a module and prepares it to handle requests.</summary>
        /// <param name="context">An <see cref="T:System.Web.HttpApplication" /> that provides access to the methods, properties, and events common to all application objects within an ASP.NET application </param>
        public void Init(System.Web.HttpApplication context) {
            context.AuthenticateRequest += new EventHandler(this.AuthenticateRequest);
        }

        /// <summary>Occurs when a security module has established the identity of the user.</summary>
        private void AuthenticateRequest(Object sender, EventArgs e) {
            HttpApplication Application = (HttpApplication) sender;
            HttpRequest Request = Application.Context.Request;
            HttpResponse Response = Application.Context.Response;
            bool allow = false; // Default is not not allow

            // Exit if we're on login.aspx, not authenticated, or no siteMapNode exists.
            if (Request.Url.AbsolutePath.ToLower() == FormsAuthentication.LoginUrl.ToLower()) return;
            if (Application.Context.User == null) Response.Redirect(FormsAuthentication.LoginUrl);
            if (SiteMap.CurrentNode == null) return;

            // Check if user is in roles
            if (SiteMap.CurrentNode.Roles.Count == 0) {
                allow = true; // No Roles found, so we allow.
            } else {

                // Loop through each role and check to see if user is in it.
                foreach (string role in SiteMap.CurrentNode.Roles) {
                    if (Roles.IsUserInRole(role)) { allow = true; break; }
                }
            }

            // Do we deny?
            if (allow == false) Response.Redirect(FormsAuthentication.LoginUrl);
        }

        /// <summary>Disposes of the resources (other than memory) used by the module that implements <see cref="T:System.Web.IHttpModule" />.</summary>
        public void Dispose() {
        }
    }
}