Examine HttpRequestContext.Principal in AuthorizeAttribute.