WebApi 2, Owin, Identity and Token authentication