.NET MVC authentication to AngularJS to .NET web API advice needed

I'm also somewhat skeptical that every new web app needs to be an SPA but one thing I'm 100% sold on as a generalist with the bulk of his experience on the client side is that a service-oriented architecture that hands off raw data rather than HTML to the client is the way to go whether you're loading prebuilt pages/views from the server and doing a lot of dynamic stuff with data after page load or building almost everything 100% with JavaScript.

The reasons this is preferable to a client-side dev are much the same as the reasons nobody wants HTML in the database. What's the client-side dev supposed to do when they want to resort a table for instance when they've been handed HTML? The performance cost of handling all that on the client is trivial compared to making another server request to do that for you. Also, HTML-building is pretty well-covered in JS-land. Sorting data and building new HTML table rows out of it is pretty trivial work for an experienced client-side dev.

And of what use is the back end architecture to a front end for another device that might need to do something exotic like implement widgets that are 100% canvas or a totally different HTML structure? Why should a client-side dev have to load up visual studio or knock on the back end devs door to make a strictly presentational tweak?

As for your concerns about the loss of strongly typed template validation, trust me when I say that if you're dealing with a competent client-side dev, you will find no .NET framework or visual studio tool that is more coal-to-diamond-to-dust-crushingly anal about well-formed, valid HTML than s/he is.

From the full-stack perspective, I like it because it means I'll never have to fish for business or app logic some yutz decided to drop into the templating layer. Not to mention the per-user load it takes off of your servers while in many cases actually improving load experience for the user in modern browsers with modern computers.

I think it's also easier to reason about the back end architecture when you've fully isolated it from all the presentation stuff. You're no longer grabbing data to mash it into some HTML. You're pulling it together to create an implementation-independent data structure that concerns itself more with general use than what's going to be done with it on the other side. IMO, that tends to lead to more consistency in how things are handled since the data is now an end goal rather than the second to last step of a process and there's fewer opportunities for unrelated concerns to get their wires crossed.

I would vote in favor #1, because I find it slightly easier to understand what's going on and control the behavior. We used this approach to build a fairly large enterprisey apps without too much fuss. It also is easily customizable, if needed (e.g. would 1 token per user suffice? Would you need multiple token if user simultaneously logs in from multiple devices?). However, it depends - as always. Both are totally viable approaches, so basically whatever you're more comfortable with, if it has all the features you need when another one doesn't.

In our case #1 was easier to implement and covered all our needs, your case might be different... or not.