How to create a CustomPrincipal globally (with and without AuthorizeAttribute)
===

I have a custom Principal/Identity for my ASP.NET MVC4 web app. I have also created a AuthorizeAttribute to instantiate my custom principal, assigning it to httpContext.User in controllers where I require Authentication.

This works great for controller/actions that have been decorated with my AuthorizeAttribute, **however, for controllers that don't require authentication (but still use it if it is there), I would like to get my CustomPrincipal (and preferably through HttpContext.User)**.

In these non-decorated controller/actions, HttpContext.User is set, but with a GenericPrincipal rather than with my CustomPrincipal. **Where would the best place to 'override' the default setting of a HttpContext.User to the GenericPrincipal?** 

As well, if this is done in every request that has an auth cookie, **how would I then avoid doing the work twice in the case of a AuthorizeAttribute decorated controller** (which would then just become one that mandated authentication).

Just to be clear, my site allows anonymous users access, but on those pages, if one is authenticated (and a CustomPrincipal is realized), there are extra features provided.

I am sure I could do this with a session, but I wanted to avoid session if possible.

I also see Application_AuthenticateRequest, but I don't think that is the prefered way. And I am not sure about custom filters set on a base controller. 

Thoughts?
