https://elanderson.net/2015/10/adding-authorize-to-a-web-api/