Ok... I don't get it. I just secured my asp.net mvc 3 app ( razor views ) with following code block in the web.config.
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
<authorization>
<deny users="?"/>
</authorization>
But when I do this, the Login page doesn't have the normal style anymore... it's just plain HTML without any css mockup. So what do I have to 'allow' in the web.config?