// Startup.cs
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // authentication has to come before authorization, or you get an infinite redirect!
    app.UseAuthentication()
    app.UseAuthorization()
}