http://www.cnblogs.com/ldp615/archive/2010/10/27/asp-net-mvc-forms-authentication-roles-authorization-demo.html
http://msdn.microsoft.com/en-us/library/ms972974.aspx