Move [Authorize] attribute from OutcomesApiControllerBase to OutcomesApiController so that application can decide whether to authorize or not.