API security best practices .cursorrules strategies