Thinking about there is something not quite right. In the WebApi, TokenWebApi, and MVC authorization attributes it is now checking user.Roles but that user object is being created by us based on just the name (but roles are never added) so everything is always going to be unauthorized.