SharePoint security problem

[Richard Bootes]

I thought I had set up project server flawlessly, but
when any user goes to the document section under
sharepoint, they have full control of the site, even
though they are only set up as team members in PWA. Is
this by default? If so, can I change it? I'm worried
about users wiping out information by accident.

I also notice that I can browse to the sharepoint project
page without being challenged, but I can't figure out in
IIS where to fix this. None of the web sites allow
anonymous access.

Any thoughts would be greatly appreciated.