It seems that even contrary to the documentation events in IIS are hooked up and processed in the order they are configured rather than in the order they should appear in the request lifecycle.
This feels like a bug in the owin request lifecycle to me but hey, I got my problem solved.