HttpApplication application = (HttpApplication)source;
            HttpContext context = application.Context;


            string requestUrl = context.Request.Url.ToString();
            //context.Response.Write("<script>alert("+requestUrl+")</script>");
            string requestPage = requestUrl.Substring(requestUrl.LastIndexOf('/') + 1);
            // "ValiDateCode.ashx?aa=Thu Jun 7 09:52:27 UTC+0800 2012"
            if (requestPage.Contains("?"))
            {
                string[] a = requestPage.Split('?');
                requestPage = a[0];
            }
            string jpg = requestPage.Substring(requestPage.LastIndexOf('.') + 1).ToString().ToLower();
            if ((requestPage == "UserLogin.aspx") || (requestPage == "ValiDateCode.ashx") || (jpg == "jpg"))//如果是登录页面或者是验证码或者是jpg则直接输出，否则判断
            {

            }
            else
            {
                if (context.Session == null || context.Session["username"].ToString().Trim() == "")
                {
                    context.Server.Transfer("~/UI/RolesManager/UserLogin.aspx");
                }
                else
                {
                    //说明username不为空，则获取用户名和请求的url
                    string userName = context.Session["username"].ToString();
                    string url = context.Request.Url.ToString();
                    // 如果用户没有被授权，请求被终止，并打印提示信息。
                    if (!Validator.CanUseModule(userName, url))
                    {

                        // application.Response.BinaryWrite();
                        application.CompleteRequest();
                        //context.CompleteRequest();
                        context.Response.Write("<script>alert(\"对不起，您无权访问此模块\")</script>");
                        //重新定向到需要转到的页面
                    }
                }
            }

if ((requestPage == "UserLogin.aspx") || (requestPage == "ValiDateCode.ashx") || (jpg == "jpg"))//如果是登录页面或者是验证码或者是jpg则直接输出，否则判断
            {

            }

------解决方案--------------------
不要用==号来判断字符串相等，这样只会判断是否在一个内存中