title: Why does base.IsAuthorized always return false when creating a custom AuthorizeAttribute?
body: <p>This filter checks to make sure incoming arguments are good. It doesn't do security checks like checking session tokens. </p>
  
  <p>I'd like to keep any existing security/authorization logic in place and just add my little bit to validate the input.</p>
  
  <pre><code> public class ValidateMachineIdTokenAttribute : AuthorizeAttribute
      {
          protected override bool IsAuthorized(HttpActionContext actionContext)
          {
              var baseAuthorized = base.IsAuthorized(actionContext); // &lt;-- always false
              CheckInput(actionContext); // throws exception if no good
              return true;
          }
         ...
     }
  </code></pre>
  
  <p>I could ignore <code>base.IsAuthorized</code> but like I said I want to keep whatever security is in place. </p>