Asp.net Core Web Api Security Best Practices