diff --git a/src/Microsoft.AspNet.Http/HttpContext.cs b/src/Microsoft.AspNet.Http/HttpContext.cs
index 89c421e5cb..191c3f02a6 100644
--- a/src/Microsoft.AspNet.Http/HttpContext.cs
+++ b/src/Microsoft.AspNet.Http/HttpContext.cs
@@ -57,14 +57,14 @@ namespace Microsoft.AspNet.Http
             return Authenticate(new[] { authenticationType }).SingleOrDefault();
         }
 
-        public abstract IEnumerable<AuthenticationResult> Authenticate(IList<string> authenticationTypes);
+        public abstract IEnumerable<AuthenticationResult> Authenticate(IEnumerable<string> authenticationTypes);
 
         public virtual async Task<AuthenticationResult> AuthenticateAsync(string authenticationType)
         {
             return (await AuthenticateAsync(new[] { authenticationType })).SingleOrDefault();
         }
 
-        public abstract Task<IEnumerable<AuthenticationResult>> AuthenticateAsync(IList<string> authenticationTypes);
+        public abstract Task<IEnumerable<AuthenticationResult>> AuthenticateAsync(IEnumerable<string> authenticationTypes);
 
         public virtual Task<WebSocket> AcceptWebSocketAsync()
         {
diff --git a/src/Microsoft.AspNet.Http/HttpResponse.cs b/src/Microsoft.AspNet.Http/HttpResponse.cs
index 6f0a6a44dd..05ae0942d3 100644
--- a/src/Microsoft.AspNet.Http/HttpResponse.cs
+++ b/src/Microsoft.AspNet.Http/HttpResponse.cs
@@ -55,12 +55,12 @@ namespace Microsoft.AspNet.Http
             Challenge(new[] { authenticationType }, properties);
         }
 
-        public virtual void Challenge(IList<string> authenticationTypes)
+        public virtual void Challenge(IEnumerable<string> authenticationTypes)
         {
             Challenge(authenticationTypes, properties: null);
         }
 
-        public abstract void Challenge(IList<string> authenticationTypes, AuthenticationProperties properties);
+        public abstract void Challenge(IEnumerable<string> authenticationTypes, AuthenticationProperties properties);
 
         public virtual void SignIn(ClaimsIdentity identity)
         {
@@ -72,12 +72,12 @@ namespace Microsoft.AspNet.Http
             SignIn(new[] { identity }, properties);
         }
 
-        public virtual void SignIn(IList<ClaimsIdentity> identities)
+        public virtual void SignIn(IEnumerable<ClaimsIdentity> identities)
         {
             SignIn(identities, properties: null);
         }
 
-        public abstract void SignIn(IList<ClaimsIdentity> identities, AuthenticationProperties properties);
+        public abstract void SignIn(IEnumerable<ClaimsIdentity> identities, AuthenticationProperties properties);
 
         public virtual void SignOut()
         {
@@ -89,6 +89,6 @@ namespace Microsoft.AspNet.Http
             SignOut(new[] { authenticationType });
         }
 
-        public abstract void SignOut(IList<string> authenticationTypes);
+        public abstract void SignOut(IEnumerable<string> authenticationTypes);
     }
 }
diff --git a/src/Microsoft.AspNet.HttpFeature/Security/IAuthenticateContext.cs b/src/Microsoft.AspNet.HttpFeature/Security/IAuthenticateContext.cs
index f44c411ffc..333c044f86 100644
--- a/src/Microsoft.AspNet.HttpFeature/Security/IAuthenticateContext.cs
+++ b/src/Microsoft.AspNet.HttpFeature/Security/IAuthenticateContext.cs
@@ -10,7 +10,7 @@ namespace Microsoft.AspNet.HttpFeature.Security
     [AssemblyNeutral]
     public interface IAuthenticateContext
     {
-        IList<string> AuthenticationTypes { get; }
+        IEnumerable<string> AuthenticationTypes { get; }
 
         void Authenticated(ClaimsIdentity identity, IDictionary<string, string> properties, IDictionary<string, object> description);
 
diff --git a/src/Microsoft.AspNet.HttpFeature/Security/IChallengeContext.cs b/src/Microsoft.AspNet.HttpFeature/Security/IChallengeContext.cs
index c5855cb322..5f32f318df 100644
--- a/src/Microsoft.AspNet.HttpFeature/Security/IChallengeContext.cs
+++ b/src/Microsoft.AspNet.HttpFeature/Security/IChallengeContext.cs
@@ -9,7 +9,7 @@ namespace Microsoft.AspNet.HttpFeature.Security
     [AssemblyNeutral]
     public interface IChallengeContext
     {
-        IList<string> AuthenticationTypes {get;}
+        IEnumerable<string> AuthenticationTypes {get;}
         IDictionary<string,string> Properties {get;}
 
         void Accept(string authenticationType, IDictionary<string,object> description);
diff --git a/src/Microsoft.AspNet.HttpFeature/Security/ISignInContext.cs b/src/Microsoft.AspNet.HttpFeature/Security/ISignInContext.cs
index b6c1730a69..694ece38d2 100644
--- a/src/Microsoft.AspNet.HttpFeature/Security/ISignInContext.cs
+++ b/src/Microsoft.AspNet.HttpFeature/Security/ISignInContext.cs
@@ -10,7 +10,7 @@ namespace Microsoft.AspNet.HttpFeature.Security
     [AssemblyNeutral]
     public interface ISignInContext
     {
-        IList<ClaimsIdentity> Identities { get; }
+        IEnumerable<ClaimsIdentity> Identities { get; }
         IDictionary<string, string> Properties { get; }
 
         void Accept(string authenticationType, IDictionary<string, object> description);
diff --git a/src/Microsoft.AspNet.HttpFeature/Security/ISignOutContext .cs b/src/Microsoft.AspNet.HttpFeature/Security/ISignOutContext .cs
index 8346ae040b..232db13ad7 100644
--- a/src/Microsoft.AspNet.HttpFeature/Security/ISignOutContext .cs	
+++ b/src/Microsoft.AspNet.HttpFeature/Security/ISignOutContext .cs	
@@ -9,7 +9,7 @@ namespace Microsoft.AspNet.HttpFeature.Security
     [AssemblyNeutral]
     public interface ISignOutContext 
     {
-        IList<string> AuthenticationTypes { get; }
+        IEnumerable<string> AuthenticationTypes { get; }
 
         void Accept(string authenticationType, IDictionary<string, object> description);
     }
diff --git a/src/Microsoft.AspNet.PipelineCore/DefaultHttpContext.cs b/src/Microsoft.AspNet.PipelineCore/DefaultHttpContext.cs
index a6b56103f8..9afbc4368c 100644
--- a/src/Microsoft.AspNet.PipelineCore/DefaultHttpContext.cs
+++ b/src/Microsoft.AspNet.PipelineCore/DefaultHttpContext.cs
@@ -178,7 +178,7 @@ namespace Microsoft.AspNet.PipelineCore
             return authTypeContext.Results;
         }
 
-        public override IEnumerable<AuthenticationResult> Authenticate(IList<string> authenticationTypes)
+        public override IEnumerable<AuthenticationResult> Authenticate(IEnumerable<string> authenticationTypes)
         {
             if (authenticationTypes == null)
             {
@@ -202,7 +202,7 @@ namespace Microsoft.AspNet.PipelineCore
             return authenticateContext.Results;
         }
 
-        public override async Task<IEnumerable<AuthenticationResult>> AuthenticateAsync(IList<string> authenticationTypes)
+        public override async Task<IEnumerable<AuthenticationResult>> AuthenticateAsync(IEnumerable<string> authenticationTypes)
         {
             if (authenticationTypes == null)
             {
diff --git a/src/Microsoft.AspNet.PipelineCore/DefaultHttpResponse.cs b/src/Microsoft.AspNet.PipelineCore/DefaultHttpResponse.cs
index 436517b0b9..3a0b19cab0 100644
--- a/src/Microsoft.AspNet.PipelineCore/DefaultHttpResponse.cs
+++ b/src/Microsoft.AspNet.PipelineCore/DefaultHttpResponse.cs
@@ -130,7 +130,7 @@ namespace Microsoft.AspNet.PipelineCore
             return Body.WriteAsync(bytes, 0, bytes.Length);
         }
 
-        public override void Challenge(IList<string> authenticationTypes, AuthenticationProperties properties)
+        public override void Challenge(IEnumerable<string> authenticationTypes, AuthenticationProperties properties)
         {
             if (authenticationTypes == null)
             {
@@ -153,7 +153,7 @@ namespace Microsoft.AspNet.PipelineCore
             }
         }
 
-        public override void SignIn(IList<ClaimsIdentity> identities, AuthenticationProperties properties)
+        public override void SignIn(IEnumerable<ClaimsIdentity> identities, AuthenticationProperties properties)
         {
             if (identities == null)
             {
@@ -175,7 +175,7 @@ namespace Microsoft.AspNet.PipelineCore
             }
         }
 
-        public override void SignOut(IList<string> authenticationTypes)
+        public override void SignOut(IEnumerable<string> authenticationTypes)
         {
             if (authenticationTypes == null)
             {
diff --git a/src/Microsoft.AspNet.PipelineCore/Security/AuthTypeContext.cs b/src/Microsoft.AspNet.PipelineCore/Security/AuthTypeContext.cs
index 20bc565605..ffd779039e 100644
--- a/src/Microsoft.AspNet.PipelineCore/Security/AuthTypeContext.cs
+++ b/src/Microsoft.AspNet.PipelineCore/Security/AuthTypeContext.cs
@@ -10,16 +10,21 @@ namespace Microsoft.AspNet.PipelineCore.Security
 {
     public class AuthTypeContext : IAuthTypeContext
     {
+        private List<AuthenticationDescription> _results;
+
         public AuthTypeContext()
         {
-            Results = new List<AuthenticationDescription>();
+            _results = new List<AuthenticationDescription>();
         }
 
-        public IList<AuthenticationDescription> Results { get; private set; }
+        public IEnumerable<AuthenticationDescription> Results
+        {
+            get { return _results; }
+        }
                 
         public void Accept(IDictionary<string, object> description)
         {
-            Results.Add(new AuthenticationDescription(description));
+            _results.Add(new AuthenticationDescription(description));
         }
     }
 }
diff --git a/src/Microsoft.AspNet.PipelineCore/Security/AuthenticateContext.cs b/src/Microsoft.AspNet.PipelineCore/Security/AuthenticateContext.cs
index 469c38cf3c..d975333fdf 100644
--- a/src/Microsoft.AspNet.PipelineCore/Security/AuthenticateContext.cs
+++ b/src/Microsoft.AspNet.PipelineCore/Security/AuthenticateContext.cs
@@ -14,33 +14,42 @@ namespace Microsoft.AspNet.PipelineCore.Security
 {
     public class AuthenticateContext : IAuthenticateContext
     {
-        public AuthenticateContext(IList<string> authenticationTypes)
+        private List<AuthenticationResult> _results;
+        private List<string> _accepted;
+
+        public AuthenticateContext(IEnumerable<string> authenticationTypes)
         {
             if (authenticationTypes == null)
             {
                 throw new ArgumentNullException("authenticationType");
             }
             AuthenticationTypes = authenticationTypes;
-            Results = new List<AuthenticationResult>();
-            Accepted = new List<string>();
+            _results = new List<AuthenticationResult>();
+            _accepted = new List<string>();
         }
 
-        public IList<string> AuthenticationTypes { get; private set; }
+        public IEnumerable<string> AuthenticationTypes { get; private set; }
 
-        public IList<AuthenticationResult> Results { get; private set; }
+        public IEnumerable<AuthenticationResult> Results
+        {
+            get { return _results; }
+        }
 
-        public IList<string> Accepted { get; private set; }
+        public IEnumerable<string> Accepted
+        {
+            get { return _accepted; }
+        }
 
         public void Authenticated(ClaimsIdentity identity, IDictionary<string, string> properties, IDictionary<string, object> description)
         {
             var descrip = new AuthenticationDescription(description);
-            Accepted.Add(descrip.AuthenticationType); // may not match identity.AuthType
-            Results.Add(new AuthenticationResult(identity, new AuthenticationProperties(properties), descrip));
+            _accepted.Add(descrip.AuthenticationType); // may not match identity.AuthType
+            _results.Add(new AuthenticationResult(identity, new AuthenticationProperties(properties), descrip));
         }
 
         public void NotAuthenticated(string authenticationType, IDictionary<string, string> properties, IDictionary<string, object> description)
         {
-            Accepted.Add(authenticationType);
+            _accepted.Add(authenticationType);
         }
     }
 }
diff --git a/src/Microsoft.AspNet.PipelineCore/Security/ChallengeContext.cs b/src/Microsoft.AspNet.PipelineCore/Security/ChallengeContext.cs
index b86f4cff8e..45afd34594 100644
--- a/src/Microsoft.AspNet.PipelineCore/Security/ChallengeContext.cs
+++ b/src/Microsoft.AspNet.PipelineCore/Security/ChallengeContext.cs
@@ -12,7 +12,9 @@ namespace Microsoft.AspNet.PipelineCore.Security
 {
     public class ChallengeContext : IChallengeContext
     {
-        public ChallengeContext(IList<string> authenticationTypes, IDictionary<string, string> properties)
+        private List<string> _accepted;
+
+        public ChallengeContext(IEnumerable<string> authenticationTypes, IDictionary<string, string> properties)
         {
             if (authenticationTypes == null)
             {
@@ -20,18 +22,21 @@ namespace Microsoft.AspNet.PipelineCore.Security
             }
             AuthenticationTypes = authenticationTypes;
             Properties = properties ?? new Dictionary<string, string>(StringComparer.Ordinal);
-            Accepted = new List<string>();
+            _accepted = new List<string>();
         }
 
-        public IList<string> AuthenticationTypes { get; private set; }
+        public IEnumerable<string> AuthenticationTypes { get; private set; }
 
         public IDictionary<string, string> Properties { get; private set; }
 
-        public IList<string> Accepted { get; private set; }
+        public IEnumerable<string> Accepted
+        {
+            get { return _accepted; }
+        }
         
         public void Accept(string authenticationType, IDictionary<string, object> description)
         {
-            Accepted.Add(authenticationType);
+            _accepted.Add(authenticationType);
         }
     }
 }
diff --git a/src/Microsoft.AspNet.PipelineCore/Security/SignInContext.cs b/src/Microsoft.AspNet.PipelineCore/Security/SignInContext.cs
index 7f9694fd2a..b24a14758a 100644
--- a/src/Microsoft.AspNet.PipelineCore/Security/SignInContext.cs
+++ b/src/Microsoft.AspNet.PipelineCore/Security/SignInContext.cs
@@ -10,7 +10,9 @@ namespace Microsoft.AspNet.PipelineCore.Security
 {
     public class SignInContext : ISignInContext
     {
-        public SignInContext(IList<ClaimsIdentity> identities, IDictionary<string, string> dictionary)
+        private List<string> _accepted;
+
+        public SignInContext(IEnumerable<ClaimsIdentity> identities, IDictionary<string, string> dictionary)
         {
             if (identities == null)
             {
@@ -18,18 +20,21 @@ namespace Microsoft.AspNet.PipelineCore.Security
             }
             Identities = identities;
             Properties = dictionary ?? new Dictionary<string, string>(StringComparer.Ordinal);
-            Accepted = new List<string>();
+            _accepted = new List<string>();
         }
 
-        public IList<ClaimsIdentity> Identities { get; private set; }
+        public IEnumerable<ClaimsIdentity> Identities { get; private set; }
 
         public IDictionary<string, string> Properties { get; private set; }
 
-        public IList<string> Accepted { get; private set; }
+        public IEnumerable<string> Accepted
+        {
+            get { return _accepted; }
+        }
 
         public void Accept(string authenticationType, IDictionary<string, object> description)
         {
-            Accepted.Add(authenticationType);
+            _accepted.Add(authenticationType);
         }
     }
 }
diff --git a/src/Microsoft.AspNet.PipelineCore/Security/SignOutContext.cs b/src/Microsoft.AspNet.PipelineCore/Security/SignOutContext.cs
index 1c8049d3cb..6ce2a64fa5 100644
--- a/src/Microsoft.AspNet.PipelineCore/Security/SignOutContext.cs
+++ b/src/Microsoft.AspNet.PipelineCore/Security/SignOutContext.cs
@@ -9,23 +9,28 @@ namespace Microsoft.AspNet.PipelineCore.Security
 {
     public class SignOutContext : ISignOutContext
     {
-        public SignOutContext(IList<string> authenticationTypes)
+        private List<string> _accepted;
+
+        public SignOutContext(IEnumerable<string> authenticationTypes)
         {
             if (authenticationTypes == null)
             {
                 throw new ArgumentNullException("authenticationTypes");
             }
             AuthenticationTypes = authenticationTypes;
-            Accepted = new List<string>();
+            _accepted = new List<string>();
         }
 
-        public IList<string> AuthenticationTypes { get; private set; }
+        public IEnumerable<string> AuthenticationTypes { get; private set; }
 
-        public IList<string> Accepted { get; private set; }
+        public IEnumerable<string> Accepted
+        {
+            get { return _accepted; }
+        }
 
         public void Accept(string authenticationType, IDictionary<string, object> description)
         {
-            Accepted.Add(authenticationType);
+            _accepted.Add(authenticationType);
         }
     }
 }