title: How are Web API access tokens validated on the server?
body: <p>Once a <code>WebAPI</code> access token is generated, how does <code>WebAPI</code> validate that token for the next request? I wonder if I can use an <code>[Authorize]</code> attribute, it must compare the token sent by the client with the token at the server side, if stored somewhere. Does it just check if token is present and not its value?</p>