api security testing tutorial