Only in MVC, the `ResourceAuthorizeAttribute` does not check for or user any present `AllowAnonymousAttribute`.