http://www.fullstackprep.dev/Articles/sda/apidesign/secure-rest-api