Designing a secure REST API without OAuth | Hacker News Reader