API security tightened up