Custom AuthorizeAttribute is not doing anything

Question

I have an Asp.Net Mvc4 application with an ApiController that looks like this: (PS: I over-simplified the logic to avoid un-necessary explanations. Imagine the acti