Token-based security in a REST API