That was from the Default.config file.  The *Paths directives are the same in all the files (Default, Admin, Guest).  I never set or override the security file being used.