improve API security