<location>
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
  </location>

<authentication mode="Forms">
      <forms loginUrl="~/Account/Login" timeout="2880" defaultUrl="~/"/>
    </authentication>

<configuration>
    ...
    <system.webServer>
        <modules runAllManagedModulesForAllRequests="true">
        ...
        </modules>
    </system.webServer>
</configuration