title: Custom Api Authorize ignoring AllowAnonymous
body: <p>I have a CustomApiAuthorizeAttribute:</p>
  
  <pre><code>public class CustomApiAuthorizeAttribute : AuthorizeAttribute
  {
      public override void OnAuthorization(HttpActionContext actionContext)
      {
          if (actionContext == null)
              throw new ArgumentNullException("actionContext");
  
          bool skipAuthorization = actionContext.ActionDescriptor.GetCustomAttributes&lt;AllowAnonymousAttribute&gt;().Any() || 
              actionContext.ActionDescriptor.ControllerDescriptor.GetCustomAttributes&lt;AllowAnonymousAttribute&gt;().Any();
  
          if (skipAuthorization) return;
  
          var cookie = HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName];
  
          if (cookie != null)
          {
              var decCookie = FormsAuthentication.Decrypt(cookie.Value);
  
              if (decCookie != null)
              {
                  if (!string.IsNullOrEmpty(decCookie.UserData))
                  {
                      HttpContext.Current.User = new CustomPrinciple(new CustomIdentity(decCookie));
                      return;
                  }
              }
          }
  
          HttpContext.Current.Items["RequestWasNotAuthorized"] = true;
  
          HttpContext.Current.Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName) { Expires = DateTime.Now.AddDays(-1d) });
  
          HandleUnauthorizedRequest(actionContext);
      }
  }
  </code></pre>
  
  <p>And I have a controller:</p>
  
  <pre><code>[CustomApiAuthorize]
  public class RacingController : CustomApiController
  {
      [HttpGet]
      [AllowAnonymous]
      public Venues Venues()
      {
          var asr = Services.GetVenues(Token);
          if(!string.IsNullOrEmpty(Token))
              SetAuthTicket(asr.Token);
          return asr.Payload;
      }
   }
  </code></pre>
  
  <p>I keep getting a 401 Unauthorized error when trying to call this action. Debugging tells me that the authorizeattribute is not detecting the presence of the [AllowAnonymous] but I don't understand why.</p>
  
  <p>Can any one see what I am doing wrong? or have any idea if something else could be conflicting?</p>