ASP.NET MVC Forms authentication - How it works and persists authentication?

I'm working on a site that uses Forms Authentication. I was interested in how the authentication system was working, since when I initially open any page in the site, it redirects me to a login, and none of the controllers/actions have any authorization logic placed in them.

• Via the configuration below, does MVC or ASP.NET automatically determine if you're authenticated? (Like I said, there is no code in the controllers to "redirect" or make sure that the user is authorized.
• If ASP.NET handles this, in what situations do you need to authorize your actions/controllers? (i.e. [Authorize] attribute)
• How does forms authentication work? I'm especially interested in how the "authorization" is persisted? (i.e. cookies??)

Websites web.config Technology: MVC 3, Entity Framework 4.1 (Code first), ASP.NET 4

<configuration>
<system.web>
        <authentication mode="Forms">
          <forms loginUrl="~/Account/Index" timeout="2880" />
        </authentication>

        <membership defaultProvider="CodeFirstMembershipProvider">
          <providers>c
            <clear />
            <add name="CodeFirstMembershipProvider" type="Vanguard.AssetManager.Services.Security.MembershipService" applicationName="/" />
          </providers>
        </membership>

        <roleManager enabled="true" defaultProvider="CodeFirstRoleProvider">
          <providers>
            <clear />
            <add name="CodeFirstRoleProvider" type="Vanguard.AssetManager.Services.Security.RoleService" applicationName="/" />
            <add applicationName="/" name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" />
          </providers>
        </roleManager>

      </system.web>

      <location path="Admin">
        <system.web>
          <authorization>
            <allow roles="Admin" />
            <deny users="*" />
          </authorization>
        </system.web>
      </location>


      <location path="Content/packages">
        <system.web>
          <authorization>
            <allow roles="Admin" />
            <deny users="*" />
          </authorization>
        </system.web>
      </location>

      <location path="Home">
        <system.web>
          <authorization>
            <deny users="?" />
          </authorization>
        </system.web>
      </location>

      <location path="CheckIn">
        <system.web>
          <authorization>
            <allow roles="CheckIn, Admin" />
            <deny users="*" />
          </authorization>
        </system.web>
      </location>

      <location path="Assignment">
        <system.web>
          <authorization>
            <allow roles="Assignment, Admin" />
            <deny users="*" />
          </authorization>
        </system.web>
      </location>
<configuration>

The site uses MVC areas, which I assume is what the section refers to.