Web API authentication and authorization using azure AD