Two things stand out for me here. First, do you allow * users instead? users * means anonymous ,? means authentication. I would change it to the following and see if that helps ...
<authorization>
<allow users="?" />
<deny users="*" />
</authorization>
, slideExpiration = "true" . - 20 ...
<forms name=".ASPXFORMSAUTH" timeout="20" slidingExpiration="true" />