I was debugging code in an MVC4 project that had Authorize attributes applied to action methods (and also to the MVC classes), and the action methods were executing even though I had not authenticated. This occurs when the application is running on the local IIS server using the default http://localhost:%5Bport#%5D.
To fix this, I setup a virtual application for the site in IIS on my dev machine, and tried running it by browsing the site through IIS (http://localhost/MyVirtualName) and the app now works as expected and redirects me to the login page.
Then I had to go back into VS, right click my web project and select PROPERTIES. Then click WEB, then change the app to ‘USE CUSTOM WEB SERVER’ and set the sever url to whatever I just used in IIS (ex:http://localhost/MyVirtualName). Now the app will work as expected when I run it in debug through IIS.