IIS Serving Child Application before hitting Parent Application Pipeline

Question

I have a parent ASP.NET Application which is supposed to provide restricted access via login (in-app login not IIS Authentication). Parent app is an MVC app (or razor p