Aspnetcore.docs: Document the fact that custom AuthorizationHandlers will still execute even if *authentication* fails

[DrEsteban]

When using requirement-based policies, it seems that all custom AuthorizationHandlers will still execute even if token validation fails. (For example expired token.)

Why does this matter?
Some AuthorizationHandlers could perform some relatively time-intensive/expensive tasks. If _authentication_ fails, there is a high chance users wouldn't want their custom AuthorizationHandlers to start evaluating requirements.

Rough draft
"Note: If token authentication fails (due to expired token, invalid cryptographic signature, etc), you may want to exit the AuthorizationHandler.HandleAsync() early. You can do this by checking context.Principal.Identity.IsAuthenticated:"

        public Task HandleAsync(AuthorizationHandlerContext context)
        {
            if (!context.User.Identity.IsAuthenticated)
            {
                return Task.CompletedTask;
            }

            // Perform expensive authorization
        }

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: b1141d92-adeb-6841-229f-914c808f9a2b
• Version Independent ID: 7089b376-949f-c1c6-c37a-5d8cc7ecf104
• Content: Policy-based authorization in ASP.NET Core
• Content Source: aspnetcore/security/authorization/policies.md
• Product: aspnet-core
• GitHub Login: @Rick-Anderson
• Microsoft Alias: riande

[Rick-Anderson]

@blowdart should I doc this? I don't see anywhere that indicates they don't run when auth fails.

[blowdart]

They also run even if another has failed, because there may be side effects like logging a developer wants. So sure, go for it.

[Rick-Anderson]

@DrEsteban or @serpent5 are you interested in creating a PR for this?

[serpent5]

Sure, I'd be happy to take a look at this.

[DrEsteban]

Thanks @serpent5 and @Rick-Anderson!