REST API security checklist

[mbohun]

Make sure we check the REST API (at least for the most important features):

• https://github.com/shieldfy/API-Security-Checklist
• https://www.owasp.org/index.php/REST_Security_Cheat_Sheet
• http://1raindrop.typepad.com/1_raindrop/2006/12/rest_security_o.html
• TODO: add more