Why is AllowAnonymous not working while deployed to Azure Websites?

I have a MVC4 web app with the following controller

[Authorize]
public class AccountController : BaseController
{
  [AllowAnonymous]
  public ActionResult SignInRegister(LoginModel loginModel, string returnUrl)
  {
    //some implementation
  }
  //other secured actions
}

This is working as expected when running locally, but as soon as I deploy it to the Free Azure Website I get a 401 error code with the message: You do not have permission to view this directory or page.

Removing the [Authorize] attribute and redeploying works as expected, adding it again and redeploying brings back the problem.

I even tried the fully qualified class names: System.Web.Mvc.Authorize and System.Web.Mvc.AllowAnonymous with the same results.

The app is using .NET 4.5 and the Azure Website is also configured to use 4.5.

UPDATE: The BaseController has an action that returns the Header as partial view which was not decorated with [AllowAnonymous]. Locally it resulted in the page being displayed without the header, but on Azure Websites the response was cut off and only returned with the error message mentioned above. I had not realized the header was missing until I purposely looked into it.

Now the question begs to be asked: why is Azure Websites overriding the response?

Solution

The BaseController has an action that returns the Header as partial view which was not decorated with [AllowAnonymous]. Locally it resulted in the page being displayed without the header, but on Azure Websites the response was cut off and only returned with the error message mentioned above. I had not realized the header was missing until I purposely looked into it.

Now the question begs to be asked: why is Azure Websites overriding the response?