Some significant security improvements have been made. see http://stackoverflow.com/questions/11775594/how-to-secure-an-aspnet-mvc-web-api