public class ServerAppStartup
{
    public static void Configuration(IAppBuilder app)
    {
        app.Map("/identity", idsrvApp =>
        {
            var factory = new IdentityServerServiceFactory {...};
            idsrvApp.UseIdentityServer(new IdentityServerOptions
            {
                SiteName = "server app",
                SigningCertificate = ...,
                RequireSsl = false,
                Factory = factory,
                AuthenticationOptions = new AuthenticationOptions {
                    RememberLastUsername = true
                },
                EnableWelcomePage = false
            });
        });

        app.SetDefaultSignInAsAuthenticationType("ClientCookie");

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationMode = AuthenticationMode.Active,
            AuthenticationType = "ClientCookie",
            CookieName = CookieAuthenticationDefaults.CookiePrefix + "ClientCookie",
            ExpireTimeSpan = TimeSpan.FromMinutes(5)
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationMode = AuthenticationMode.Active,
            AuthenticationType = OpenIdConnectAuthenticationDefaults.AuthenticationType,
            SignInAsAuthenticationType = app.GetDefaultSignInAsAuthenticationType(),

            Authority = options.BaseUrl+ "identity",

            ClientId = options.ClientId,
            RedirectUri = options.RedirectUri,
            PostLogoutRedirectUri = options.PostLogoutRedirectUri,

            ResponseType = "code id_token",
            Scope = "openid profile offline_access",

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthorizationCodeReceived = async n =>
                {
                    /* stuff to get ACCESS TOKEN from CODE TOKEN */
                },

                RedirectToIdentityProvider = n =>
                {
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                    {
                        var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token");

                        if (idTokenHint != null)
                        {
                            n.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                        }
                    }

                    return Task.FromResult(0);
                }
            }
        }

        JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>();

        app.UseNancy();
        app.UseStageMarker(PipelineStage.MapHandler);
    }

using System;
using Nancy.ModelBinding;
using Nancy.Security;
namespace Server.Modules
{
    public class UsersModule : BaseModule
    {
        public UsersModule() : base("/users")
        {
            Get["/getall"] = parameters =>
            {
                this.RequiresMSOwinAuthentication();
                ...
                return ...;
            };
        }
    }
}

public class TestServer: IDisposable
{
    private Func<IDictionary<string, object>, Task> _appFunc;
    public static CookieContainer CookieContainer;
    public Uri BaseAddress { get; set; }
    // I uses OwinHttpMessageHandler becaouse it can handle http redirections
    public OwinHttpMessageHandler Handler { get; private set; }
    public HttpClient HttpClient => new HttpClient(Handler) { BaseAddress = BaseAddress };

    public static TestServer Create()
    {
        CookieContainer = new CookieContainer();
        var result = new TestServer();

        var appBuilder = new AppBuilder();
        appBuilder.Properties["host.AppName"] = "WebApi server";

        /* Use configuration of server app */
        ServerAppStartup.Configuration(appBuilder);

        result._appFunc = appBuilder.Build();
        result.Handler = new OwinHttpMessageHandler(result._appFunc)
        {
            AllowAutoRedirect = true,
            AutoRedirectLimit = 1000,
            CookieContainer = CookieContainer,
            UseCookies = true
        };

        return result;
    }

    public void Dispose()
    {
        Handler.Dispose();
        GC.SuppressFinalize(this);
    }
}

namespace ServerSpec.Specs.Users
{
    public class GetAllUsersSpec
    {
        private TestServer _server;

        public GetAllUsersSpec(){
            server = TestServer.create();
        }

        [Fact]
        public void should_return_all_users()
        {
            /* here I will get error because http client or rather its cookie handler has no authentication cookie */
            var users = Get("/users/getall");
            ...
        }

        public TResponse Get<TResponse>(string urlFragment)
        {
            var client = server.HttpClient();

            var httpResponse = client.GetAsync(urlFragment).Result;
            httpResponse.EnsureSuccessStatusCode();
            return httpResponse.Content.ReadAsAsync<TResponse>().Result;
        }
    }
}