Architecting a Secure RESTful Node.js app