OData controllers are decorated with the Authorize attribute if session refresh is enabled in the security settings.