https://github.com/ServiceStack/Test

I clone above(MVC project) because I don't have redis or PostgreSql,
so i setup ormlite.sqlite use next code it

 var path = "~/dd.db".MapAbsolutePath();
container.Register<IDbConnectionFactory>(c => new OrmLiteConnectionFactory(
                                     path, SqliteDialect.Provider));
container.Register<ICacheClient>(c => new MemoryCacheClient());

now I have 3 questions:
1: at homecontrol/Login
why should call FormsAuthentication.SetAuthCookie(); since AuthenticateAttribute depend on 'ss-pid', it has no mater with '.ASPXAUTH'

using (var authService = ResolveService<AuthenticateService>())
                    {
                        var response = authService.Authenticate(new Authenticate
                        {
                            provider = CredentialsAuthProvider.Name,
                            UserName = userName,
                            Password = password,
                            RememberMe = true,
                        });

                        // add ASP.NET auth cookie
                    FormsAuthentication.SetAuthCookie(userName, true);
//  
                        return Redirect(string.IsNullOrEmpty(redirect) ? "/" : redirect);
                    }

2:although I login(use test,test), it set cookie to me, but '/api/auth' also return HTTP/1.1 401 Unauthorized?
3: if I use Session in services, I should save Session manualy , and it will auto save in ServiceStackController, is it right?

A working live demo of the MVC Project is available at: http://mvc.servicestack.net/

SetAuthCookie() provided some integration with MVC Auth as it was the previous way of telling
MVC the User is Authenticated but it shouldn't be needed in this example.

2:although I login(use test,test), it set cookie to me, but '/api/auth' also return HTTP/1.1 401 Unauthorized?

The example is working for me so not sure what's different with your setup, maybe if you publish the raw HTTP Request/Response Headers it will provide some insight into what the issue is as I can't tell from here.

3: if I use Session in services, I should save Session manualy , and it will auto save in ServiceStackController, is it right?

ServiceStack Sessions are just your Typed User Sessions saved in the registered ICacheClient at the key indicated by Session Cookies, so there's not 2 different Sessions, the ServiceStackController Session APIs are just wrappers around ServiceStack's dependencies so it's retrieving the same Session.

The only time ServiceStack saves your Session is when it first creates it after the User successfully authenticates. So when you modify your User Session you're just modifying a C# instance of your POCO AuthUserSession which you'll need to call SaveSession() in order for it to be persisted to the registered ICacheClient.

Note you don't need to register MemoryCacheClient as ServiceStack automatically registers it by default if you haven't registered one:

//container.Register<ICacheClient>(c => new MemoryCacheClient());

I try many times as it always none auth.

you can rename the picture ".gif" to ".saz" open by fiddler.(as you can see statistics panel,the response is very slow)
I only change IDbConnectionFactory to OrmLiteConnectionFactory ,the other is as same as git.
and my os is WIN7 64 VS2015 UPDATE3

Note: downloading and renaming the image didn't work.

But I just had a look at your test example and the problem is that you're using the wrong MapAbsolutePath() to generate the path which is pointing to the /bin folder which IIS detects there's a change in the file system and restarts the appdomain nuking your In Memory Cache which invalidates all authenticated sessions and restarts the app.

Ideally you should only be writing to files in your projects App_Data so it will work if you change it to:

var path = "~/App_Data/db.sqlite".MapHostAbsolutePath();
container.Register<IDbConnectionFactory>(c => 
    new OrmLiteConnectionFactory(path, SqliteDialect.Provider));

good, it works fine now, thank you!