Securing an API – an example