the Authorize attribute doesn't work unless you explicitly define the authentication scheme in it - C#