Fixes #130, respect AllowAnonymous attribute when it is used. Also added AllowAnonymous attribute to XmlSiteMapController so it will allow search engines if a global AuthorizeAttribute is used.