Sorry to jump in on this thread but I'm a new user of XAMPP too and have a similar security problem.
I have installed XAMPP ok and am using the cointrol panel to start and stop Apache as and when required as sugested here.
However I am reading the readme notes and "A matter of security (A MUST READ!)" in particular. When I try to open the link to or go to http://localhost/security/
to set up the passwords as suggested, my browser returns with...
You don't have permission to access the requested object. It is either read-protected or not readable by the server.
If you think this is a server error, please contact the webmaster.
When I browse the directory in file explorer I have read permissions on the directory and all below it.
I'm logged on with administrator priveliges on a Vista OS.
Any help greatly appreciated.