Ten Steps for Token based API Security