http://fullstackprep.dev/Articles/sda/apidesign/secure-rest-api