title: ASP.NET Core: calling a view component does not respect authorization attribute
body: <p>I implemented AspNetCore.Authorization and decorated the controller classes with <code>[Authorize]</code>. This works, if I call the Controller from the Browser. View Component can however access the data:</p>
  
  <p>View:</p>
  
  <pre><code>@foreach (Category category in Model) {
      &lt;a class="btn btn-block
         asp-action="Index"
     asp-controller="Note"
     asp-route-categoryid=@category.CategoryID
     asp-route-page="1"&gt;
      @category.Name
  &lt;/a&gt;
  </code></pre>
  
  <p>This leads to the View Component been filled with data from @category.Name actually not accessible by the browser's address bar.</p>
  
  <p>ViewComponent:</p>
  
  <pre><code>[Authorize]
  public class NavigationMenuViewComponent : ViewComponent
  {
      private INoteRepository _Repository;
      public NavigationMenuViewComponent(INoteRepository repository)
      {
          _Repository = repository;
      }
      public IViewComponentResult Invoke()
      {
          ViewBag.SelectedCategory = RouteData?.Values["category"];
          return View(_Repository.Categories
              .OrderBy(x =&gt; x.Name));
      }
  }
  </code></pre>
  
  <p>Actually I thought, the <code>Authorize</code> attribute will reject the call from the view component if not actually logged in. How can I get to such behavior?</p>