Silverlight InitializeError #2103 Invalid or malformed application: Check manifest

This one took me ages to find, so if you get the error InitializeError #2103 Invalid or malformed application: Check manifest, there are three possibilities: MIME type, startup object and security.

Add MIME type to your web server. Map ".XAP"  to "application/x-silverlight".
Make sure the startup object is correct on silverlight app, properties, Silverlight tab
Make sure that your web.config allows anonymous access to the ClientBin\that.xap if the page containing the silverlight control that points to that.xap allows anonymous access. Thjs is tricky and normally overlooked. The error message from silverlight is misleading. The way it works is that the web page gets displayed on the browser first. It then tries to fetch the that.xap. If it fails due to security restriction, it still shows that misleading error message. To fix that, add this to your web.config

    <location path="ClientBin">
                <allow users="?"/>