[ApiAuthorize]
BaseController:ApiController
WebApiConfig
register()
//config.SuppressDefaultHostAuthentication();
//config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
原文：http://www.cnblogs.com/yfann/p/4542786.html