http://www.fullstackprep.dev/articles/sda/apidesign/secure-rest-api