Session notes for API security at application level

Format: Discussion dump, from start to finish, followed by some
takeaways. If you were at the session, please pile on.