5 Requirements for Protecting APIs Against Attacks