you need to assign the role, preferably inside Application_AuthenticateRequest, seeRole-based Security with Forms Authentication
http://www.codeproject.com/aspnet/formsroleauth.asp