Authorize attribute vs manual authorization on NewThread action