Security testing scenarios for web APIs