Replace this
<authorization>
<deny users="?" />
</authorization>
With this
<authorization>
<deny users ="?" />
<allow users = "*" />
</authorization>
In the first configuration you are blocking all users and forgetting to allow access to authenticated users.
Look here for more information.