public TenantAuthController()
{
   _serviceContext = new MobileServiceContext();
   _signingKey = Environment.GetEnvironmentVariable("WEBSITE_AUTH_SIGNING_KEY");
   var website = Environment.GetEnvironmentVariable("WEBSITE_HOSTNAME");
   _audience = $"https://{website}/";
   _issuer = $"https://{website}/";
}

[HttpPost]
public IHttpActionResult Post([FromBody] TenantLoginRequest request)
{
   if (string.IsNullOrEmpty(request.TenantName) || string.IsNullOrEmpty(request.Password)) return BadRequest();
   (var valid, var tenant) = ValidateAuthRequest(request);
   if (!valid) return Unauthorized();

   var claims = new[]
   {
      new Claim(JwtRegisteredClaimNames.Sub, $"{tenant.Id}")
   };

   var token = AppServiceLoginHandler.CreateToken(claims, _signingKey, _audience, _issuer, TimeSpan.FromDays(365)); // TODO Token refresh

   return Ok(
      new TenantLoginResponse
      {
         Tenant = tenant,
         Token = token.RawData,
      }
   );
}