MVC 4 - Losing custom principal between beginrequest and endrequest

Question

In my project (c#), we have an HttpModule that creates a custom Principal that we attach to the CurrentPrincipal.

This is working in all of our MVC3 apps and in our classic ASP.Net apps.

We have an AuthorizeAttribute override we use to secure our Controller methods - seems pretty standard.

The problem is that in the custom authorizeAttribute, the user (httpContext.User) is a RolePrincipal and not the custom principal.

To troubleshoot, I put some handlers in my global.asax to trap beginrequest() and endrequest(). Well, in BeginRequest my User is what we expect - the custom principal. In EndRequest, the user is a RolePrincipal again. The web.config declarations of the HttpModule are good - I can step thru the HttpModule's code.

Does anyone know what's going on? We have a custom HttpModule, but I can't modify that code for this project (it's being used everywhere and it works fine).

This is my first MVC4 project - I'm wondering if MVC4 does something differently.

Code below. Is there any info I've left out?

edit: added authorizationattribute code.

Code
      (In HttpModule)
    private void BeginRequest(object Sender, EventArgs e)
    {
        HttpContext context = HttpContext.Current;
        var Id = new TASBIdentity();
        context.User = new TASBPrincipal(Id);
        Thread.CurrentPrincipal = context.User;
                      (etc...)

    (In global.asax)
    void Application_BeginRequest(object sender, EventArgs e)
    {
        HttpContext context = HttpContext.Current;
        var user = context.User;  // user is correct type
    }

    void Application_EndRequest(object sender, EventArgs e)
    {
        HttpContext context = HttpContext.Current;
        var user = context.User;    // user is default type (not correct)
    }

   (In the authorizeattribute)
public class SecuredByFunctionAttribute : AuthorizeAttribute
{
    private readonly string _functionKey;

    public SecuredByFunctionAttribute(string functionKey)
    {
        _functionKey = functionKey;
    }
    protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
    {
        return httpContext.User.IsInRole(_functionKey);
    }