How do you deal with authorisation on actions that return results other than ViewResult? How do you deal with authorisation on actions that return results other than ViewResult? json json