Clean up explanation of testing security. Improve formatting. Add references in HTTP RESTful API.