Implementing a Web API authentication filter