api security fixes