MVC5 Web API2 Unauthorized Behaviour

Hello,

When starting a new MVC5 project using the "Individual User Accounts" approach that uses the OWIN middleware, there seem to be an issue with the Web API controllers. When you return an "Unauthorized" response from an ApiController, these responses seem to be intercepted and turned into "302 Found" instead, which is clearly NEVER what you want with an ApiController. This should only be default behvaiour for normal MVC Controllers.

This issue was not present with the previous MVC4 templates where ApiControllers that returned Unauthorized would not get intercepted and turned into "302 Found".

Is this not a bug?

Here's a link to StackOverflow that discusses this exact issue and possible hacks for working around the issue: http://stackoverflow.com/questions/18728631/httpstatuscoderesult401-returns-302-found