Another permission denied is on the blog.js file which is served thru BE's js.axd handler:
The RSS feed is using BE's syndication.axd file -- which isn't working as you pointed out.
But, the CSS.axd handler built into BE *does* work interestingly:
The reason why the CSS.axd handler works is because the path to CSS.axd is not in the root of your blog (it's in a subfolder). All the other AXD URLs are /blog/xxx.AXD, but the CSS AXD URL is /blog/themes/Standard/CSS.AXD.
The other AXD handlers work (they don't return 403) if we add a folder name before AXD. For example with the WebResource.axd mentioned above, if I add /test in the path, it actually works:
This is fun, but doesn't really solve the problem though :)
Are you using the web.config file that comes with BE?
I'm wondering if you have some type of URL rewriting going on. Do you have control over the parent folder (i.e. www.studentcasa.com) ? If you do, I would check the root / parent folder's web.config file, and look for a <rewrite> section
inside of it. If you've modified the BE web.config file, you might even have a <rewrite> section in your BE web.config file. There's other URL rewriting technologies out there, but the <rewrite> one is for the IIS7 Rewrite Module.
This may not be the case, but it might be that a rewriting rule is rewriting requests for AXD to some other path or filename which is leading to the Access Denied message.