Some weird problem when using UmbracoApiController. [U-7.1.6 assembly: 1.0.5350.25714]

I have a controller that uses UmbracoApiController. When I request a url 'umbraco/api/CReview/Delete/4', it says 'Authorization has been denied' on the production server, even i have logged in as admin.

Locally it works fine, no problem. It's only problem on the production server.

public class CReviewController : UmbracoApiController
    {

        [System.Web.Http.AcceptVerbs("GET", "POST")]
        [System.Web.Http.HttpGet]
        [Umbraco.Web.WebApi.UmbracoAuthorize]
        public string Delete(string id)
        {
            // delete operation goes here
            return "true";
        }

    }