title: Apply [Authorize] attribute implicitly to all Web API controllers
body: <p>My application is setup where all requests except login must be 'authorized' using the authorization attribute in Web API.  E.g.</p>
  
  <pre><code> [Authorize]
   [HttpGet, Route("api/account/profile")]
   public ApplicationUser Profile()
   {
         return userModel;
   }
  </code></pre>
  
  <p>and only the login needs to not authorize since thats where you get the token ;)</p>
  
  <pre><code>[AllowAnonymous]
  [HttpPost, Route("api/account/login")]
  public async Task&lt;IHttpActionResult&gt; Login(LoginViewModel model)
  {
     ....
  }
  </code></pre>
  
  <p>instead of having to add the <code>[Authorize]</code> attribute to ALL my routes, is there a way to set it globally?</p>