Today, you will need to set both of the following for user principal if you use a custom message handler to perform authentication in the web hosted scenario.

        IPrincipal principal = new GenericPrincipal(new GenericIdentity("myuser"), new string[] { "myrole" });
        Thread.CurrentPrincipal = principal;
        HttpContext.Current.User = principal;

We should add an extension method to make it easier.