apply a little bit of secure coding practices to the API