ASP.NET Forms Authentication considered broken
blog.appharbor.com