title: WebAPI [Authorize] returning error when logged in
body: <p>I'm trying to set up a <code>WebAPI</code> with <code>MVC5</code> / <code>Web Api 2</code>, it's currently using default configurations and other defaults right now. When I log in with an account in the browser, I can go to regular <code>MVC</code> controller actions with the <code>[Authorize]</code> attribute just fine, such as the Home page shows as it should when authorized, but then if I go to <code>/api/Me</code> (a default built-in api controller action) or any custom api controller action I've built with the default MVC Web Api 2 scaffolding that requires authorization, I get an error like so:</p>
  
  <pre><code>{"message":"Authorization has been denied for this request."}
  </code></pre>
  
  <p>This is when I'm trying it in Microsoft Edge, I haven't tried it on my actual client code I'm building yet, which is a <code>UWP</code> app. I figured I would test in the browser first to ensure things are working properly.</p>
  
  <p>I started looking at this article: <a href="https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/individual-accounts-in-web-api" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/individual-accounts-in-web-api</a> It seems to be more geared towards <code>Ajax</code> requests and <code>SPAs</code> though. My goal is having things working through both the web and through <code>UWP</code>. I will probably focus more time on the <code>UWP</code> side than developing a robust web app with ajax, since the app will run in an intranet and access an intranet IIS server running the web api, I'd like to build a desktop client in UWP and eventually Xamarin that access data through Web Api.</p>
  
  <p>Is it safe for me to assume that if you're using a regular web browser like Edge you cannot access Web Api controller actions when they are secured through the <code>[Authorize]</code> attribute, since it doesn't send an access token in the header?</p>