当不支持HTTP方法时,Web API 2不会说unauthorized

"message": "The requested resource does not support http method 'GET'."

但是当我发送一个POST请求时,我得到了这样的回复:

"message": "Authorization has been denied for this request."

我不应该得到未经授权的消息,无论我做什么,如果我没有授权,甚至没有认证?

方法如下:

[Route("api/search"), HttpPost, Authorize]
public async Task<IHttpActionResult> Search()
{
   ...
}

[Authorize] 属性,我还有一个全局过滤器集。