Forms Authentication -- Why 302 on Login form?

[Long, but I hope the solution is simple.]

I believe this code was working in the past (perhaps a year ago).  Now, I've come back to it and it doesn't work.  I've cut it back to the minimum, and it still doesn't work.  I suspect I'm just missing or forgetting some very simple little thing.

Client and server are both running on my dev machine, at localhost 127.0.0.1.
The dev machine I'm working on has:
    Window 2000 Professional (Win2KPro)
    Microsoft-IIS/5.0
    .NET CLR 1.1.4322
    Internet Explorer 6.0 (MSIE 6.0)
I am running Norton AntiVirus and ZoneAlarm Pro.

The problem is that the user authentication doesn't seem to "stick" from the Login form back to the Redirect URL.  It's as if the user never was authenticated.

I've got two web pages, (1) WebForm1.aspx, which requires an authenticated user, and (2) Login.aspx, the login form.

I test using this use case:
(A) With WebForm1.aspx set as the start page, start the application. It goes to WebForm1.aspx ...
(B) but there is no authenticated user, so it is automatically redirected to Login.aspx.
(C) In the Login.aspx, enter user and password: "guest", "guest", and click the Login button to POST it back to Login.aspx
(D) The Login page authenticates the user, then calls RedirectFromLoginPage, so ...
(E) ... it goes to WebForm1.aspx ...
(F) ... but it (INCORRECTLY) is automatically redirected to Login.aspx, even though the login was authenticated.
What's going on here?

Can you help get this working?

I've added some Debug.Writeline() statements to document the path taken through the code, matching steps A thru F.  They produce the following output.

Application_AuthenticateRequest: /LoginX/WebForm1.aspx
Application_AuthenticateRequest: /LoginX/Login.aspx?ReturnUrl=%2fLoginX%2fWebForm1.aspx
Application_AuthenticateRequest: /LoginX/Login.aspx?ReturnUrl=%2fLoginX%2fWebForm1.aspx
Authenticated: guest, guest
Application_AuthenticateRequest: /LoginX/WebForm1.aspx
Application_AuthenticateRequest: /LoginX/Login.aspx?ReturnUrl=%2fLoginX%2fWebForm1.aspx


The http://localhost/LoginX/Trace.axd shows info below.
Note that the status code is 302 when the Login.aspx is POSTed.  Why is this?  Why would it be 200 the first time, for the GET, then 302 for the second time?  I know that you can set specific access for different verbs in web.config, but I haven't done that.  See the web.config listing below.

No. Time of Request File Status Code Verb
1 3/16/2005 3:54:48 AM /WebForm1.aspx ... 302 GET View Details
2 3/16/2005 3:54:50 AM /Login.aspx ...... 200 GET View Details
3 3/16/2005 3:58:32 AM /Login.aspx ...... 302 POST View Details
4 3/16/2005 3:58:32 AM /WebForm1.aspx ... 302 GET View Details
5 3/16/2005 3:58:32 AM /Login.aspx ...... 200 GET View Details

(Note: If you enter anything but guest, guest, the login page will try to redirect to default.aspx, which doesn't exist, so you'll get a "404 Not Found" error.  That's as expected.)

If needed, I can easily provide exact instructions and code listings to create the project.  It's already written up, but it's a few pages long.

--- listing of web.config ---
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
      <system.web>
            <compilation defaultLanguage="vb" debug="true" />
            <customErrors mode="RemoteOnly" />

            <authentication mode="Forms">
                  <forms name=".ASPXCOOKIEAUTH2"
                        path="/"
                        loginUrl="Login.aspx"
                        protection="All"
                        timeout="60">
                        <credentials passwordFormat="Clear">
                              <user name="guest" password="guest" />
                        </credentials>
                  </forms>
            </authentication>

            <authorization>
                  <allow users="*" /> <!-- Allow all users -->
            </authorization>

            <trace enabled="false" requestLimit="10" pageOutput="false" traceMode="SortByTime" localOnly="true" />
            <sessionState
                        mode="InProc"
                        stateConnectionString="tcpip=127.0.0.1:42424"
                        sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes"
                        cookieless="false"
                        timeout="20"
            />
            <globalization requestEncoding="utf-8" responseEncoding="utf-8" />
      </system.web>
 
       <!-- Deny unauthenticated users to WebForm1. -->
    <location path="WebForm1.aspx">
        <system.web>
            <authorization>
                <deny users="?" />
            </authorization>
        </system.web>
    </location>

</configuration>
--- end listing of web.config ---