Loading: The State of API Security