I configured FormAuthentication on IIS 10 like so:

This is a website that is an angular app and /login is an actual route that should bring up login page. When I hit the main page (/) it does get redirected correctly to /login?ReturnUrl=%2f but the browser shows :
HTTP Error 401.2 - Unauthorized You are not authorized to view this page due to invalid authentication headers.
As far as I can tell it happens before the login page gets a chance to see the request (no breakpoints get hit).
Did I configure IIS incorrectly and if so what should it have been?