Demonstration of how to write WebAPI controller that acts as proxy for SPA apps to protect access tokens, yet still allow normal request construction to occur within the client.