I'm assuming you are using this VF page in a site, as I can't see how else you'd get an authorization required.

One thing to be aware of is that you'll end up on the authorization page if an error occurs in your controller, as the standard behaviour is to direct you to a platform error page.  

Its worth turning debug logging on to see if there is an error generating your list.

My controller code:

public with sharing class SelectPlanController {
	private String state;
	private String utility;
	private String promocode;
	private Map<String, String> mapMDLinks = new Map<String, String>{
		'XX' => 'some0.php',
		'XX2' => 'some1.php',
		'BLAH' => 'some2.php'	};
	private String MDLINK = 'http://www.company.com/appName/';
	private List<Plan__c> plans = new List<Plan__c>();
	
 	public SelectPlanController()
 	{	
 		state = ApexPages.currentPage().getParameters().get('f1');
 		utility = ApexPages.currentPage().getParameters().get('f2');
 		promocode = ApexPages.currentPage().getParameters().get('f3');
 		
 		plans = [select name, planId__c, HasCancelFee__c, PlanPrice__c, PlanTerm__c, PlanSaving__c, UDCCode__c, UDCName__c, state__c, State_Name__c, PriceToCompare__c from plan__c where state__c=:state and Utility__c=:utility];
 		
 	}
 	
 	public List<Plan__c> getAvailablePlans()
 	{
 		return plans;
 	}
 	
 	public PageReference runaway()
 	{
 		PageReference p=null;
 		if( state == 'XX')
 		{
	 		p = new PageReference( MDLINK + mapMDLinks.get(utility));
	 		p.setRedirect(true);
 		} else if( utility == 'YYYY')
 		{
 			p = Page.UtilityNotServed;
 			p.setRedirect(true);
 		}
 		return p;
 	}
}

 My page has:

<apex:repeat value="{!AvailablePlans}" var="p">
  <c:MyCustomComponent pid="{!p.PlanID__c}" .. />
</apex:repead>

The debugger (monitor) logged:

16:12:35.705|SOQL_EXECUTE_BEGIN|[20]|Aggregations:0|select name, planId__c, HasCancelFee__c, PlanPrice__c, PlanTerm__c, PlanSaving__c, UDCCode__c, UDCName__c, state__c, State_Name__c, PriceToCompare__c from plan__c where state__c=:state and Utility__c=:utility
16:12:35.710|SOQL_EXECUTE_END|[20]|Rows:2
16:12:35.710|CODE_UNIT_FINISHED|SelectPlanController <init>
16:12:35.711|CODE_UNIT_STARTED|[EXTERNAL]|01pE00000008UDv|SelectPlanController invoke(runaway)
16:12:35.711|CODE_UNIT_FINISHED|SelectPlanController invoke(runaway)
16:12:35.711|VF_APEX_CALL|j_id0|{!runaway}|PageReference: none
16:12:35.712|CODE_UNIT_STARTED|[EXTERNAL]|01pE00000008UDv|SelectPlanController get(AvailablePlans)
16:12:35.712|CODE_UNIT_STARTED|[EXTERNAL]|01pE00000008UDv|SelectPlanController invoke(getAvailablePlans)
16:12:35.712|CODE_UNIT_FINISHED|SelectPlanController invoke(getAvailablePlans)
16:12:35.712|CODE_UNIT_FINISHED|SelectPlanController get(AvailablePlans)
16:12:35.782|CUMULATIVE_LIMIT_USAGE
16:12:35.782|LIMIT_USAGE_FOR_NS|(default)|
  Number of SOQL queries: 1 out of 100
  Number of query rows: 2 out of 50000
  Number of SOSL queries: 0 out of 20
  Number of DML statements: 0 out of 150
  Number of DML rows: 0 out of 10000
  Number of script statements: 14 out of 200000
  Maximum heap size: 0 out of 3000000
  Number of callouts: 0 out of 10
  Number of Email Invocations: 0 out of 10
  Number of fields describes: 0 out of 100
  Number of record type describes: 0 out of 100
  Number of child relationships describes: 0 out of 100
  Number of picklist describes: 0 out of 100
  Number of future calls: 0 out of 10

16:12:35.782|CUMULATIVE_LIMIT_USAGE_END

16:12:35.741|CODE_UNIT_FINISHED|VF: /apex/SelectPlan
16:12:35.741|EXECUTION_FINISHED