title: .NET Core API using Microsoft Identity Platform returns 200 when OIDC access token has expired
body: <p>I have created an API in .NET Core, and I am using Microsoft Identity Platform for authentication. Everything works fine, but when my access token has expired my methods still return http status 200, but with no result, but I would expect them to return 401 instead.</p>
  <p>In the ConfigureServices method of the Startup class I initialize the authentication by adding this line:</p>
  <pre><code>services.AddMicrosoftIdentityWebApiAuthentication(Configuration);
  </code></pre>
  <p>And in the Configure method I call <code>app.UseAuthentication()</code> and <code>app.UseAuthorization()</code>. Finally, in the controller the methods use the Authorize attribute:</p>
  <pre><code>[HttpGet]
  [Authorize]
  public ActionResult&lt;IEnumerable&lt;string&gt;&gt; Get()
  </code></pre>
  <p>So, when making a call to the Get method using an expired bearer token, I would expect the method to return a 401, but I get a 200 with no result. Any ideas?</p>