Web Api Custom Authorize Attribute Properties

I'm trying to extend he default Web Api authorize attribute to allow authenticated users to have access to a set of actions even though they are not registered in the application (e.g., they don't have a role).

 public class AuthorizeVerifiedUsersAttribute : AuthorizeAttribute
    {
        /// <summary>
        /// Gets or sets the authorized roles.
        /// </summary>
        public new string Roles { get { return base.Roles; } set { base.Roles = value; } }

        /// <summary>
        ///  Gets or sets the authorized users.
        /// </summary>
        public new string Users { get { return base.Users; } set { base.Users = value; } }

        private bool _bypassValidation;
        /// <summary>
        /// Gets of sets a controller or an action as an authorization exception
        /// </summary>
        public virtual bool BypassValidation
        {
            get
            {
                Debug.WriteLine("get:" + TypeId.GetHashCode() + " " + _bypassValidation);
                return _bypassValidation;
            }
            set
            {
                Debug.WriteLine("set:" + TypeId.GetHashCode() + " " + value);
                _bypassValidation = value;
            }
        }

        protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            if (HttpContext.Current.User.Identity.IsAuthenticated)
            {
                if (BypassValidation)
                {
                    return true;
                }
                else
                {
                   //return false if user is unverified

                }
            }

            return base.IsAuthorized(actionContext);
        }
    }

And it is being used like this:

 [AuthorizeVerifiedUsers]
 public class UserProfileController : ApiController
 {

    [AuthorizeVerifiedUsers(BypassValidation = true)]
    public bool Verify(string verificationCode)
    {}
 }

So far this action is the only that is using the BypassValidation = true.

The issue arises because the BypassValidation property is false for the action even though the Debug window - used in the BypassValidation property - shows the following:

set:26833123 True set:39602703 True get:43424763 False get:43424763 False get:43424763 False //call that should have "True"...

I noticed two things:

• The TypeId (The unique identifier for the attribute) is different between the calls that have BypassValidation = true and the ones that have BypassValidation = false.
• The id '43424763' doesn't have a corresponding set

Any ideas?

Thanks in advance, Joao