.Net MVC 4 CAS Authentication

I need to authenticate User from a central CAS. The assumption are these:

1. The UserId for authentication is in a Request Header
2. The roles for authorization are given by a web service.
3. The application must cache the authorization phase.

I've tried this:

In the Global.asax:

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
    {
        const string SiteMinderHeaderToken = "SM_USER";
        if (HttpContext.Current.User == null || !HttpContext.Current.User.Identity.IsAuthenticated)
        {

            var userSSO = HttpContext.Current.Request.Headers[SiteMinderHeaderToken];
            GenericIdentity webIdentity = new GenericIdentity(userSSO, "SiteMinder");

            string[] roles = { "ROLE1", "ROLE2" };
            GenericPrincipal principal = new GenericPrincipal(webIdentity, roles);
            HttpContext.Current.User = principal;



            // System.Web.Security.FormsAuthentication.SetAuthCookie(userSSO, true);

        }
    }

In the Web.config

<authentication mode="None"   />
<authorization>
  <deny users="?" />
</authorization>

The problem is that for every request, the HttpContext.Current.User is always null, and every time all the authentication and authorization phase are done.

If I uncomment

System.Web.Security.FormsAuthentication.SetAuthCookie(userSSO, true);

All is fine, after the first request the User is authenticated.

My questions are:

1. Is it correct to call System.Web.Security.FormsAuthentication.SetAuthCookie even if there isn't FormAuthentication?
2. Is there a way to do it better?
3. Are there some security issues doing this way?

Thanks