You can use Windows or Forms authentication for MVC.
When using razor views, do you have to take any special steps to proctect your asp.net mvc application from cross site scripting (XSS) attacks?