API security for modern web apps