You are only denying access to the user 'muru'. It means that users other than 'muru' can access the application anonymously.
If you want to prevent the users to access the FrmWelcom or other pages without login to the system, your web.config should be as below
<authorization>
<allow users="sonia"/>
<allow users="soni"/>
<deny users="muru"/>
<deny users="?"/>
</authorization>
The '?' in deny element prevents anonymous access to the resources.
Also the set the second argument in the statement FormsAuthentication.RedirectFromLoginPage to false.
FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);
Setting true will create a durable cookie (one that is saved across browser sessions). Therefore you need to set it as false.