Used custom authentication filter instead of AuthorizationAttribute for Web Api authentication