The Biggest API Security Fails - And How to Fix Them