Maybe it's useful to someone: After converting my app to MVC 4 with .NET framework 4.5 and installing the framework on my server with IIS 7.0 I encountered the same 'forbidden' error mentioned in the question. I tried all options described above to no avail, when I noticed the
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
was missing from my web.config. After adding this, everything worked. Simple, but easy to overlook...
EDIT:
Of course the solution above will work, but it is indeed a waste of resources. I think it is better to add the routing module as pointed out by Chris Herring in the comments.
<system.webServer>
<modules>
<remove name="UrlRoutingModule-4.0" />
<add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition="" />
</modules>
</system.webServer>