For controller actions we provide a User property on ApiController. We should also have a User property on HttpActionContext for authorization filters.
↧