This has worked for me, not sure why:
Try commenting out ScriptModule from the web config and instead adding it as described in the link below.
Though I have seen on another site another module prevented redirection to the login page - so try commenting out custom modules to see if you get the desired behaviour.

Config under module:
<add name="ScriptModule" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" preCondition="managedHandler" />

Link:
http://epiwiki.se/developing/core-functionality/initialize-a-http-module-in-runtime

We don't have the ScriptModule registered in web.config. We have;

• InitializationModule
• ShellRoutingModule
• FirstBeginRequestModule
• Initializer
• WorkflowRuntime
• UrlRewriteModule

And three custom modules, which I have commented out for testing purpose.

We also have:

<add name="StaticFileHandler" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />

And for each VPP:

<location path="files">
	<system.webServer>
		<handlers>
			<add name="webresources" path="WebResource.axd" verb="GET" type="System.Web.Handlers.AssemblyResourceLoader" />
			<add name="wildcard" path="*" verb="*" type="EPiServer.Web.StaticFileHandler, EPiServer" />
		</handlers>
	</system.webServer>
	<staticFile expirationTime="-1.0:0:0"/>
</location>

This is what the error looks like http://demo.episerver.com/Global/StartPage/Alloy_launch_register_button.jpg. I've changed the access rights in the StartPage folder in the demo website.

there are various modules installed on that demo site
one idea is that you use a default alloy site web config on your test/dev site
to see if it helps

As per my previous post, we don't have any custom modules or settings. We have used the config files from Deployment Center (not the example websites).

But I've also tested with the config files from Alloy Tech.

Do you get the desired behaviour in your local Alloy demo?

- You are welcome to open a support ticket for this

Only when I run the website in Cassini. Not in integrated mode.

I will open a ticket. Thanks!

I found a module that caught all errors which stopped the error to bubble up to the FormsAuthenticationModule. I excluded the UnauthorizedAccessException from the module, and now it works!

The module was registered in code, that's why I didn't see it first.