Questions to ask about securing an API