https://protectonce.com/9-api-security-best-practices-devs-need-to-know/