How do I identify urls for pages that don't need forms authentication?

Here's the situation: most pages on the website require login.  A few do not; these public ones are listed in web.config in sections that go <location path="blah.aspx"> <system.web> <authorization> <allow users="*" />.  The rest have to get a forms authentication ticket, which they are granted by an HttpModule that handles the AuthenticateRequest event.  When it doesn't grant one, the request gets redirected to our "login" page, which is actually an error-message page that terminates the application.  (This is because user login is handled by a separate portal, rather than within our own app.)  The most common way that the "login" error page gets invoked is when someone's authentication times out -- then the next time they click something, it redirects to the error page, which says "OurApp timed out due to inactivity".
This all works fine for normal page loads.  ...