web application and api protections