I've created an ASP.NET MVC application, i've installed successfully the WebAPI, and now i use ajax request to get the api's data.  

Some data should be available only after user authenticates, and only if it is in a certain role. Is there a way to do that? 

C# WebApi code:

```
public class TestController : ApiController
{
    [HttpGet]
    [Authorize(Roles = RoleTypes.Admin +","+ RoleTypes.Enabled)]
    public string Query()
    {
    string test = "test";
    return test;
    }

}

```

My JavaScript code: 

```
  // Here i should get the tokenKey but where should i set it? is this approach right?
var token = sessionStorage.getItem(tokenKey);
var headers = {};
    if (token) {
        $.ajaxSetup({
            headers: {
                'Authorization': "Bearer " + token
            }
        });
    }

    $.get("/api/Test/Query", function (data) {
    //stuffs here
      });
}

```