asp.net - How to exclude a controller from being authenticated -

i have overriden iautheticationfilter in asp.net web api project. here class:

public class tokenauthentication : attribute, iauthenticationfilter {     private readonly string realm;      public bool allowmultiple { { return false; } }      public tokenauthentication(string realm)     {         this.realm = "realm=" + realm;     }      public task authenticateasync(httpauthenticationcontext context, cancellationtoken cancellationtoken)     {         var request = context.request;          // receive token client. here example when token in header:         var token = request.headers.getvalues("token").elementat(0);          ...          }         return task.fromresult(0);     }       public task challengeasync(httpauthenticationchallengecontext context, cancellationtoken cancellationtoken)     {         context.result = new resultwithchallenge(context.result, realm);         return task.fromresult(0);     } } 

now need exclude login controller being authenticated:

curently when run project every request trtiggers code if put [authorize], [allowanonymous] or no filters @ all.

here add filter:

      public static void registerhttpfilters(system.web.http.filters.httpfiltercollection filters)     {                    filters.add(new tokenauthentication(""));     } 

i think, mix authentication , authorization. want exclude login controller being authorized.
 [authorize] , [allowanonymous] attributes used in authorization context , have nothing authentication. that's why iauthenticationfilter called every time.
article useful http://www.asp.net/web-api/overview/security/authentication-and-authorization-in-aspnet-web-api.