Securing APIs without breaking changes