title: System.Web.Http.AuthorizeAttribute not recognizing custom role provider
body: <p>In my MVC 4 Web API project, I have a custom role provider that works as designed via <code>System.Web.Mvc.Authorize</code> attribute on my Home <code>System.Web.Mvc.Controller</code>.</p>
  
  <p>On any <code>System.Web.Http.ApiController</code> with <code>System.Web.Http.Authorize</code> the custom role provider never gets called, always returning false. Is there a way to specify that the Web API AuthorizeAttribute pick up my custom role provider like the MVC AuthorizeAttribute?</p>
  
  <p>Role Provider:</p>
  
  <pre><code>public class CustomRoleProvider : RoleProvider
  {        
      //Overriden methods
      public override string[] GetRolesForUser(string username)
      {
          //Always return "Master" for testing purposes
          return new string[] { "Master" };
      }
  
      public override bool IsUserInRole(string username, string roleName)
      {
          //Always return true for testing purposes
          return true;
      }
  
      //Other overridden method stubs...
  }
  </code></pre>
  
  <p>Web.config: </p>
  
  <pre><code>&lt;roleManager defaultProvider="CustomRoleProvider" enabled="true" cacheRolesInCookie="false" &gt;
    &lt;providers&gt;
      &lt;clear /&gt;
      &lt;add name="CustomRoleProvider" type="MyApp.SecurityExtensions.CustomRoleProvider, MyApp" /&gt;
    &lt;/providers&gt;
  &lt;/roleManager&gt;
  </code></pre>