title: Passing and verifying the OWIN Bearer token in Query String in WebAPI
body: <p>Short Version:
  I need to pass and verify the OWIN bearing token as a query parameter rather than in the request header.</p>
  
  <p>How do I then get the method to authorized based on that token string?</p>
  
  <p>Background:
  I want to call a webapi method to download a file as a stream (and never want the user to download it from a known file location).</p>
  
  <p>I can't get this to work if I also need to set a custom Request header i.e. the bearer token.</p>
  
  <p>I should be able to pass the token in the query string - but don't know how to get that token to then authenticate the user.</p>
  
  <p>Do I need to filter? Do I need a special claim etc?
  Does the webapi method need to include "access_token" as one of the function parameters?</p>