I removed the additional tested rule again.
<location path="Style.css">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
I checked the status of the CSS file in browser as specified by @explunit in comments. The status this time is 302 found and clicking the CSS link does not display the CSS file. I think the CSS was cached by the browser thats why it displayed it for the first time.