UAT environment used to be locked with Windows/Basic Authentication. There is an issue with Sitecore media items (mainly XSLT) when site is locked with Windows Authentication. 401 unauthorized issue. We need to give anonymous access only to media items like XSLT. Thanks to Ankit Agarwal who gave the solution.
In applicationHost.config, add these lines,
<anonymousAuthentication enabled="true" />
<basicAuthentication enabled="false" />
This solved the issue with Media items.