Start documenting REST API security