See http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api