This prevents all requests under this application from passing unless you authenticate. For aspx pages this is fine and dandy, but for the webresource requests AJAX controls needs this is a problem, because IIS does not return the scripts/stylesheets, but the error page.
So, add a location element to provide access to the needed handlers:
<configuration>
...
<location path="Telerik.Web.UI.WebResource.axd">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
...
</configuration>
Or, turn on the CDN so webresources are used as rarely as possible:
http://www.telerik.bg/help/aspnet-ajax/scriptmanager-cdn-support.html and http://www.telerik.bg/help/aspnet-ajax/stylesheetmanager-cdn-support.html. The MS AJAX scripts, however, will still be taken from webresource, I think. Take a look at the requests in the browers and let the needed ones pass.