How to lock down paths in ASP.NET MVC?

I'm playing around with MVC 4 for the first time to check out what's been changed/added/etc compared to MVC 3.

To start off, I created a blank MVC 4 Web Application and started building from scratch.

One of the first things that I noticed that is different in MVC 4 is the fact that the following web.config settings have no affect on the accessibility of the web pages:

<configuration>
    <location path="">
    <system.web>
      <authorization>
        <deny users="?"/>
      </authorization>
    </system.web>
    </location>
    .....
</configuration>

Back in MVC 3, the authorization settings above would deny all anonymous users from accessing any content within the site. However, if I add the same settings to an MVC4 Web.config file, an anonymous has free reign over an URL that s/he chooses.

What do I need to do in MVC 4 to lock-down all paths like I did in MVC 3?