a web.config with something like this would cause that
<authorization>
<deny users="?" />
</authorization>
that basically says don't allow anonymous users so it would redirect to login url defiend on the <forms element
I would look around for any extra web.config files especially in sub folders below /Data if you don't find an issue in the main web.config