Ok ..
Deleted everything and started again (table, files .. all new)
Defined the security against the user table and the group.
I don't understand why my login page has to be restricted (I mean should this be the one page that isn't?) .. but I tried both with and without .. no difference.
Attached are more screenshots and the two pages following the changes I made.
Do I need to go through authenticate user?
Thanks.