How to tackle OWASP API security risks with minimal resources