https://kevinsec.io/blog/api-broken-authentication-common-testing-patterns/