[AllowAnonymous] attribute annotated to an action tells ASP.NET that anonymous users may execute this action method. It is needed to override the [Authorize] attribute annotated on the class definition
[AllowAnonymous] public ActionResult Login(LoginModel model, string returnUrl) { ... }