According to various articles (e.g. here and here) attribute results on ASP.NET MVC Actions may be cached and not executed again when a con
I just finished a spirited discussion with Craig Stuntz (the author of the first article you listed).
I ended up using an AuthorizeAttribute with AuthorizeCore to guarantee that authorization is called even in the event the page is cached.