I have created a brand new web form application from Visual Studio 2013 and set the following in the web.config file:
The solution it's not completely deactivating the whole authentication system.
The problem may be caused by the access control not correctly setting Login.aspx permission when using the FriendlyUrls module. So you must force the permissions also for the Login page by it's "friendly" name. In the folder where login page it's stored, possibly will already be a web.config file that you may setup like this:
...
...
Note: Take care with other pages currently in the same folder and setup accesses accordingly.