It makes only some sense that this filter is, by default (i.e. by scaffolding) applied to the a `Login` action, as far as I know, this token works best when already associated with a login id. With it applied to `Login`, I have a problem if the user tries to log in twice, with an error such as

> 
> The provided anti-forgery token was meant for user "", but the current
>  user is "[theLoggedInUser]".
> 
> 
> 

Now a user logging in twice wouldn't normally be a problem, but for this, so the added effort of preventing this makes less sense, subject to answers to this question, than simply removing the validation from the login action.