In my application, key query string parameter can be used to grant access to certain actions/views.
Now I want all ActionLinks and Forms to automatically in
Having a querystring parameter that controls authorization is a bad idea IMHO. What's stopping me from adding this parameter to my url that didn't contain?
The preferred way to implement authorization is to use roles (http://msdn.microsoft.com/en-us/library/system.web.security.roleprovider.aspx).