I'm building a website which requires a very secure setup.

Part of the content is for members only, and must be served using https, to prevent such things such as session hijacking etc. I've created two iis applications, with two seperat application pools pointing to two seperat folders. Both webapps share the same db though, and I've managed to bypass small issues with the caches of the two webapps being out of sync.

The other day a read an old thread though, which covered a similar topic and more or less said, that all umbraco apps must share the same iis folders. (I can't find that thread anymore)

Is this still correct?

If this setup is legal (which I hope :), which folders need to be synched between the webapps, and what is the best way of doing this.