title: Asp.Net Identity: Web Api request fails authorization, returns 200 OK
body: <p>I am getting up to speed on Asp.Net Identity in .NET 4.5.  I setup a <a href="http://www.asp.net/identity/overview/getting-started/adding-aspnet-identity-to-an-empty-or-existing-web-forms-project">test app</a> that registers, logs in, and attempts to make a call to an Api Controller that requires a Claim of "Admin":</p>
  
  <pre><code>[Authorize(Roles="Admin")]
  public class WorkController : ApiController
  </code></pre>
  
  <p>When a request is made that does not have the Claim of "Admin", the Web Api still returns 200-OK, but with the JSON of: <code>{Message:"Authorization has been denied for this request."}</code></p>
  
  <p>This seems a little odd to me, since this does not represent successful request.  I was expecting a 401 error.  I am having trouble finding information on how to customize the response, or return a proper status code....I guess I should ask if 401 is even proper for this, or is the 200 the correct status code to use, and I should just handle it?</p>
  
  <p>edit:  For some reason it is now returning 401.  Now I don't understand why I was getting the JSON message earlier if it was denied?</p>