we've had the same problem. it seems to be related to the userprovider and handling of anonymous users. from what I can see the included userprovider does not handle this very well.