asp.net-mvc - Owin, WebApi, and UseCookieAuthentication

Question

I've configured OWIN in my ASP.NET MVC application using cookie authentication, but when I attempt to access an ApiController with an Authorize attribute on it, authorization fails and I can't figure out why. Stepping into the IsAuthorized method of the Authorize attribute, I can see that none of the identity properties that are present when accessing an MVC controller are present, so it certainly appears (at least to the authorize attribute) that the user is not authenticated.

The app is configured as follows:

public void ConfigureAuth(IAppBuilder app)
{
    app.CreatePerOwinContext(MyAuthContext.Create);
    app.CreatePerOwinContext<MyUserManager>(MyUserManager.Create);

    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString("/Account/Login"),
        Provider = new CookieAuthenticationProvider
        {
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<MyUserManager, MyUser>(
                validateInterval: TimeSpan.FromMinutes(30),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
        }
    });

    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

        var httpConfig = new HttpConfiguration();
        WebApiConfig.Register(httpConfig);
        app.UseWebApi(httpConfig);
}

Do I absolutely have to use bearer tokens for WebAPI or is there just something I'm missing.