title: First external login attempt redirects back to login action, second one works
body: <p>I'm using OWIN's external authentication providers in my ASP.Net MVC 5 / WebApi 2 project and I've hit a strange problem.</p>
  
  <p>The login workflow is exactly like here on SO. User hits the login page, picks a provider and gets logged in. My problem is that the first click on a provider redirects back to the same login page: </p>
  
  <pre><code>http://localhost:57291/Account/Login?ReturnUrl=%2fAccount%2fExternalLogin
  </code></pre>
  
  <p>This would make sense if the ExternalLogin action would be lacking the AllowAnonymous attribute.</p>
  
  <p>When the user clicks a second time everything works.</p>
  
  <p>I've also tried that with different browsers and the problem is consistent across Chrome, IE11 and Firefox.</p>
  
  <p><strong>Login.cshtml:</strong></p>
  
  <pre><code>@using (Html.BeginForm("ExternalLogin", "Account", new { ReturnUrl = ViewBag.ReturnUrl }))
  {
      &lt;fieldset&gt;
          &lt;legend&gt;@Strings.ExternalAuthenticationProvidersDescription&lt;/legend&gt;
          &lt;p&gt;
              @foreach (var p in Model.ExternalAuthenticationProviders)
              {
                  &lt;button type="submit" name="provider" value="@p.AuthenticationType" title="Log in using your @p.Caption account"&gt;@p.Caption&lt;/button&gt;
              }
          &lt;/p&gt;
      &lt;/fieldset&gt;
  }
  </code></pre>
  
  <p><strong>AccountController.cs</strong></p>
  
  <pre><code>public class AccountController : Controller
  {
    ...
  
      [AllowAnonymous]
      [HttpPost]
      public ActionResult ExternalLogin(string provider, string returnUrl)
      {
          return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new
          {
              loginProvider = provider, 
              ReturnUrl = returnUrl
          }));
      }
    ...
  }
  </code></pre>
  
  <p><strong>ChallengeResult.cs:</strong></p>
  
  <pre><code>public class ChallengeResult : HttpUnauthorizedResult
  {
      public ChallengeResult(string provider, string redirectUrl)
      {
          LoginProvider = provider;
          RedirectUrl = redirectUrl;
      }
  
      public string LoginProvider { get; set; }
      public string RedirectUrl { get; set; }
  
      public override void ExecuteResult(ControllerContext context)
      {
          context.HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties
          {
              RedirectUri = RedirectUrl
          }, LoginProvider);
      }
  }
  </code></pre>
  
  <p><strong>FilterConfig.cs</strong></p>
  
  <pre><code>public class FilterConfig
  {
      public static void RegisterGlobalFilters(GlobalFilterCollection filters)
      {
          filters.Add(new HandleErrorAttribute());
  
          // make all api controllers secure by default
          filters.Add(new AuthorizeAttribute());
      }
  }
  </code></pre>