gistfile1.cs

                var options = new FormsAuthenticationOptions
                {
                    AuthenticationMode = AuthenticationMode.Active,
                    CookieHttpOnly = true,
                    CookieName = "controll.auth.id",
                    CookiePath = "/",
                    CookieSecure = CookieSecureOption.Never,
                    ExpireTimeSpan = TimeSpan.FromMinutes(10),
                    ReturnUrlParameter = "ReturnUrl",
                    SlidingExpiration = true,
                    Provider = new FormsAuthenticationProvider()
                };
                app.SetDataProtectionProvider(new DpapiDataProtectionProvider());
                
                app.UseFormsAuthentication(options);
                app.MapPath("/auth", builder => builder.UseHandler((req, res) =>
                    {
                        if (req.Method == "POST")
                        {
                            res.StatusCode = 302;
                            res.AddHeader("Location", "/authed");
                            res.ReasonPhrase = "Found";

                            ////Here you handle form data and verify user name and password. We're just skipping that
                            res.SignIn = new Tuple<IPrincipal, IDictionary<string, string>>(
                                new ClaimsPrincipal(new GenericIdentity("TheUser", "AuthType")),
                                new Dictionary<string, string>());
                            return;
                        }

                        var body = Encoding.ASCII.GetBytes("Use POST god dammit!");
                        res.Body.Write(body, 0, body.Length);
                        res.StatusCode = 200;
                        res.ReasonPhrase = "OK";
                    }));