public class AuthOperationHandler : HttpOperationHandler<HttpRequestMessage, HttpRequestMessage>
{
    public AuthOperationHandler() : base("response")
    {
    }
 
    protected override HttpRequestMessage OnHandle(HttpRequestMessage request)
    {
        var credentials = ExtractCredentials(request.Headers.Authorization);
        var authenticated = IsAuthenticated(credentials);