Playing with SPA, WebApi 2 and Identity