API security hardening