title: Google Authentication [HostAuthentication(DefaultAuthenticationTypes.ExternalBearer)] returns UNAUTHORIZED
body: <p>I have a MVC 5 App which is calling a WebAPI.  The WebAPI uses bearer tokens for authentication.  There is one method(action) in the WebAPI which I want to use the token returned by Google for authentication purpose.  In order to do that I do the following to the WebAPI Method</p>
  
  <pre><code>[OverrideAuthentication]
  [HostAuthentication(DefaultAuthenticationTypes.ExternalBearer)]
  [Route("{userName}")]
  public async Task&lt;User&gt; GetUser(string userName)
  </code></pre>
  
  <p>Despite this I still get an UNAUTHORIZED error from the WebAPI.  What do I need to do to fix this?  In addition to this when I use
      [HostAuthentication(DefaultAuthenticationTypes.ExternalBearer)]
  How does the API validate the token?</p>