Make AuthenticationManager async mostly

Author: HaoK

src/Microsoft.AspNet.Http.Abstractions/Authentication/AuthenticationManager.cs

@@ -1,7 +1,6 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
-using System;
 using System.Collections.Generic;
 using System.Security.Claims;
 using System.Threading.Tasks;
@@ -48,14 +47,15 @@ public Task SignInAsync(string authenticationScheme, ClaimsPrincipal principal)
             return SignInAsync(authenticationScheme, principal, properties: null);
         }
 
-        public Task ForbidAsync(string authenticationScheme, AuthenticationProperties properties)
+        public Task ForbidAsync(string authenticationScheme)
         {
-            return ChallengeAsync(authenticationScheme, properties, ChallengeBehavior.Forbidden);
+            return ForbidAsync(authenticationScheme, properties: null);
         }
 
-        public Task ForbidAsync(string authenticationScheme)
+        // Deny access (typically a 403)
+        public Task ForbidAsync(string authenticationScheme, AuthenticationProperties properties)
         {
-            return ForbidAsync(authenticationScheme, properties: null);
+            return ChallengeAsync(authenticationScheme, properties, ChallengeBehavior.Forbidden);
         }
 
         public abstract Task ChallengeAsync(string authenticationScheme, AuthenticationProperties properties, ChallengeBehavior behavior);

src/Microsoft.AspNet.Http/Authentication/DefaultAuthenticationManager.cs

@@ -65,9 +65,6 @@ public override async Task AuthenticateAsync([NotNull] AuthenticateContext conte
 
         public override async Task ChallengeAsync([NotNull] string authenticationScheme, AuthenticationProperties properties, ChallengeBehavior behavior)
         {
-            // TODO: move this somewhere else
-            HttpResponseFeature.StatusCode = 401;
-
             var handler = HttpAuthenticationFeature.Handler;
 
             var challengeContext = new ChallengeContext(authenticationScheme, properties?.Items, behavior);

test/Microsoft.AspNet.Http.Tests/Authentication/DefaultAuthenticationManagerTests.cs

@@ -27,7 +27,6 @@ public async Task ChallengeWithNoAuthMiddlewareMayThrow()
             var context = CreateContext();
             await context.Authentication.ChallengeAsync();
             Assert.Equal(200, context.Response.StatusCode);
-
             await Assert.ThrowsAsync<InvalidOperationException>(() => context.Authentication.ChallengeAsync("Foo"));
         }