http://fullstackprep.dev/articles/sda/apidesign/secure-rest-api