I am trying to use the ASP.NET Web API Self-Host option with Windows authentication so I can determine the logged on user and ultimately accept or reject the user based on their
Have you tried putting the [Authorize] attribute on your controller?
[Authorize] public class HelloController : ApiController