title: Delegating Handler in ASP.Net Web API returning incorrect status code
body: <p>I have an ASP.Net Web API with the following delegating handler:</p>
  
  <pre><code>public class AuthenticationHandler : DelegatingHandler
  {
      public ILogger Logger { get; set; }
      public AuthenticationHandler(ILogger logger)
      {
          this.Logger = logger;            
      }
  
      protected override Task&lt;HttpResponseMessage&gt; SendAsync(HttpRequestMessage request, System.Threading.CancellationToken cancellationToken)
      {
          X509Certificate2 certificate = request.GetClientCertificate();
  
          if (certificate == null)
          {
              Logger.LogWarning("No certificate found on the request.");
              return Task&lt;HttpResponseMessage&gt;.Factory.StartNew(
                  () =&gt; request.CreateResponse(HttpStatusCode.Unauthorized));
  
          }
  
          if (!IsValidCertificate(certificate))
          {
              Logger.LogWarning("Certificate found on the request is not valid. Thumbprint : " + certificate.Thumbprint);
              return Task&lt;HttpResponseMessage&gt;.Factory.StartNew(
                  () =&gt; request.CreateResponse(HttpStatusCode.Unauthorized));
          }
      }
  }
  </code></pre>
  
  <p>The handler is registered in Global.asax.cs. The site is hosted in IIS 8.5. 
  The problem is instead of returning Unauthorized in case of a wrong certificate, it is returning a status of 500 Internal server error on the client side. There is no issue with correct certificate. Also, There seems no exception, if i put the code block in a try/catch. While debugging, the code returns the async task with unauthorized status code, but client receives 500. No error is logged in Event viewer. The Web API is using .Net 4.5.1.</p>
  
  <p>Is there something I am missing? Any help is appreciated.</p>