Hacking a mobile API and how to protect yourself