title: Web-API, DelegatingHandler and security. Principal is reset in Controller
body: <p>I've a <a href="http://msdn.microsoft.com/en-us/library/system.net.http.delegatinghandler.aspx" rel="nofollow">DelegatingHandler</a> in my Web-API service that, based on the headers provided, set a custom IPrincipal (ServicePrincipal) on the Thread.CurrentPrincipal and on the HttpContext.Current.User. This is all done on a call to <a href="http://msdn.microsoft.com/en-us/library/system.net.http.delegatinghandler.sendasync.aspx" rel="nofollow">SendAsync</a>.</p>
  
  <p>However, when the call get's into the Controller, the User property, the HttpContext.User and the Thread.CurrentPrincipal have all been mysteriously set to a RolePrincipal.</p>
  
  <p>Does anyone know either what I'm doing wrong, or how to prevent the additional principal being set?</p>
  
  <p>Thanks,<br />
  Kieron</p>