https://webcoding.tech/posts/server_exploring_web_api_security_best_practices.html