WebApi 2 OAuth implementation for session management