title: MVC4 / IIS / Forms Authentication SSO issue
body: <p>I’ve got a weird intermittent issue with MVC4 / IIS / Forms Authentication. </p>
  
  <p>I’ve got a pair of sites that pass control to each other using SSO. Most of the time the handover occurs correctly and the user is redirected to the next site as intended. However, in some cases, the user is asked to log in again, even though valid SSO information was sent across. The <code>SSO</code> method is decorated with the <code>[AllowAnonymous]</code> attribute and the <em>web.config</em> also has a location entry granting access to <em>/account/sso</em> to all users. </p>
  
  <p>It appears to occur when the destination site is being hit for the first time  - once the app pool is warmed up, the issue disappears. </p>
  
  <p>Some other points: </p>
  
  <p>1 both sites are .net 4, so there should not be any legacy encryption issues. <br />
   2. this issue happens quite rarely (&lt;10% of the time) so the code itself <em>should</em> be sound<br />
   3. Hosting is IIS 7.5 on win7x64 locally, and azure - happens in both places<br />
   4. Seems to be browser independent</p>
  
  <pre><code>&lt;location path="account/sso"&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;allow users="*" /&gt;
          &lt;/authorization&gt;
      &lt;/system.web&gt;
  &lt;/location&gt;
  
  [Authorize]
  public class AccountController : BaseControllerTestable
  {
      public AccountController()
          : base()
      {
      }
  
      [AllowAnonymous]
      public ActionResult SSO(string AuthToken, string Target)
      {
          //SSO logic here
  
      }
  }
  </code></pre>
  
  <p>Any ideas?</p>