This ought to be a FAQ, so I thought I'd at least document it here on my blog so that search engines will pick it up.
Avalon Express applications provide a model for deploying browser-based applications securely. An Avalon Express application consists of a regular-looking executable (plus any library dependencies), an application manifest (with a .manifest extension), and an Express deployment manifest (with a .xapp extension). You can browse to the .xapp file from any machine with Internet Explorer and the WinFX Runtime installed, and Avalon will dynamically download, cache and execute the application within a browser-based security sandbox. But to enable this to work, you need to first have configured IIS to serve the .xapp and .manifest files with the correct MIME type handler (application/manifest and application/x-ms-xapp respectively). We actually provide a script to do this automatically, but it's perhaps buried rather too deeply in the documentation for people to find it without guidance.
Anyway, the bottom line is that if you want to deploy an Avalon Express application, it's worth visiting this page first to get hold of the script to register MIME types and file extensions. If you skip this step, you'll probably just get an access denied message or simply served the contents of the .xapp file rather than the application executing.
Update: If you are using Apache, you can add the required MIME types using a .htaccess file, placed in your deployment folder. Add the following lines:
AddType application/x-ms-xapp xapp
AddType application/manifest manifest
AddType application/deployment application