API security testing methodology