private static void CreateImage(HttpContext context, int width, int height, string filename, string virtualPath)
        {
            var img = context.Request.Files[0];
            var bitmap = new Bitmap(img.InputStream);
            var avatarBitmap = new Bitmap(bitmap, width, height);
            var graphic = Graphics.FromImage(avatarBitmap);
            graphic.SmoothingMode = SmoothingMode.AntiAlias;
            graphic.InterpolationMode = InterpolationMode.HighQualityBicubic;
            // Draw the new graphic based on the resized bitmap
            graphic.DrawImage(avatarBitmap, 0, 0, width, height);
            var extention = Path.GetExtension(img.FileName);
            filename += extention;
            var path = context.Server.MapPath(virtualPath + filename);
            var manager = context.GetOwinContext().GetUserManager<ApplicationUserManager>();
            var user = manager.FindById(long.Parse(context.User.Identity.GetUserId()));
            var oldImgPath = string.Empty;
            if (user != null)
            {
                oldImgPath = user.AvatarUrl;
                user.AvatarUrl = filename;
            }
            if (File.Exists(context.Server.MapPath(virtualPath + oldImgPath)) && !oldImgPath.Equals("Default.jpg"))
                File.Delete(context.Server.MapPath(virtualPath + oldImgPath));
            if (File.Exists(context.Server.MapPath(virtualPath+"Thumbnail/" + oldImgPath)) && !oldImgPath.Equals("Default.jpg"))
                File.Delete(context.Server.MapPath(virtualPath + "Thumbnail/" + oldImgPath));

            avatarBitmap.Save(path);
            manager.Update(user);
            bitmap.Dispose();
            avatarBitmap.Dispose();
            graphic.Dispose();
        }
 /// <summary>
 /// Called when [unauthorized].
 /// </summary>
 /// <param name="context">The context.</param>
 protected virtual void OnUnauthorized(HttpContext context)
 {
     //WebSecurity.Logout();
     //FormsAuthentication.SignOut(); // it is ok to use this here, since that is what WebSecurity calls anyway
     context.GetOwinContext().Authentication.SignOut();
     // now check if store is accessible
     context.Response.Redirect(context.Request.RawUrl);
 }