sitemap.xml for auth sites

Nope, all your urls will contain whatever "auth/logged_in_start" is. You should let them in to the original content. Don't display a 403, that's respons should be for everyone accessing a valid url and aren't logged in.

Sorry, I thought you suggested to send a 403. The ones that aren't logged in I redirect to a page with "register" and "login" links.

So, should I log the bot in as a user that I have prepared and let the bot crawl inside? I can't find so much about this on the net which makes me doubt if this is the way to go. 

Another approach is of course that I whip up some public static pages that demonstrate the content that is available for registered users.