You don't want to be testing WebSecurity, only your own code - so you need a way to test your controller action without supplying a real WebSecurity class.
There are lots of ways to do this, but judging by the nature of your question I think you want the simplest approach possible (rather than the most elegant) in which case I would recommend you don't actually test the controller action and all it's associated MVC plumbing, but pull out your logic and just test that, eg:
public Test1Controller
{
public ActionResult SomeMethod()
{
//do mvc stuff
//do WebSecurity stuff
//do your stuff
MyLogicHere();
}
//public only so it can be tested
public MyLogicHere()
{
//the logic in here does not have dependencies on difficult to test types
}
}
Then in your test class you are just testing Test1Controller.MyLogicHere
(which does not need WebSecuirity).
Either that or really get to grips with DI, Interfaces, Mocks etc...