Security hotspot in web.api