Moved [Authorize] attribute from OutcomesApiControllerBase.cs to instance so application can decide whether to enforce authorization or not. Also cleaned up some code styling issues.