In MVC5 the security layer works on OWIN, I'd like to see the rest of the stack like routing also decoupled from modules and handlers, fingers crossed for MVC6.