title: Correct usage of AuthorizationFilterAttribute
body: <p>Say I have a xml like the following which gets posted to an api controller:</p>
  
  <pre><code>&lt;request&gt;
  &lt;header&gt;&lt;api_key&gt;Somekey&lt;/api_key&gt;&lt;/header&gt;
  &lt;/request&gt;
  </code></pre>
  
  <p>If I want to validate the api key in a custom AuthorizationFilterAttribute like so: </p>
  
  <pre><code>public override void OnAuthorization(HttpActionContext actionContext)
  {
      // Deserialize the posted message and validate the api key.
  }
  </code></pre>
  
  <p>How can I do that without having to manually deserialize it?</p>