RC2 tooling, new project using local accounts.

1: The TwoFactorUserId cookie middleware seems to be set to somehow running automatically (tho the AutomaticAuthN is not set AFAICT). This has the side effect of interfering with the primary authentication cookie and the User claims. So in short, I'm seeing all the claims from both the main cookie merged with the claim in the TwoFactorUserId cookie. For example, I put this in a view:

<h1>Claims</h1>
<dl>
    @foreach(var claim in User.Claims)
    {
        <dt>@claim.Type</dt>
        <dd>@claim.Value</dd>
        <dd>@claim.Issuer</dd>
    }
</dl>

Even for an anonymous user shows:

Claims
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
97e6826a-b32a-4067-8f6b-ce5cd70c53b2

2: Also, it's using the Name claim type to store the user's user ID, so it seems more appropriate to use the NameIdentifier claim type instead. Especially if you can't fix the first issue for RTM.

3: Once I login with 2FA, the TwoFactorUserId cookie is not getting cleared.

4: All of the above is also true for the TwoFactorRememberMe cookie and claims.