Securing webAPI HTTPBasic & ApiKey