title: IAuthorizationFilter's OnAuthorization method not being called
body: <p>I've written a custom authorization filter for use with the AngularJS XSRF approach however the filter isn't being called.</p>
  
  <p>The strange thing is that I copied it from another project and it seems to work fine there.</p>
  
  <p>Here's the attrubute/filter code.</p>
  
  <pre><code>    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
      public sealed class ValidateAngularAntiForgeryTokenAttribute : FilterAttribute, IAuthorizationFilter
      {
          public void OnAuthorization(AuthorizationContext filterContext)
          {
              string token = filterContext.RequestContext.HttpContext.Request.Headers["X-XSRF-TOKEN"];
              object sessionToken = filterContext.RequestContext.HttpContext.Session["XSRF-TOKEN"];
  
              if (string.IsNullOrEmpty(token) || sessionToken == null || sessionToken.ToString() != token)
              {
                  throw new UnauthorizedAccessException();
              }
          }
      }
  </code></pre>
  
  <p>And here it is adorning an action in a WebAPI controller.</p>
  
  <pre><code>[Authorize]
  public class WorksOrdersController : ApiController
  {        
      [HttpPost]
      [ValidateAngularAntiForgeryToken]
      public void EmailJob(int id, EmailModel model)
      {
         // do something
      }
  }
  </code></pre>
  
  <p>Do I have to add something to the Web.config to get it to work? I can't see anything dramatically different in the web.config of the project that's actually working.</p>