Best practice for very secure authentication in asp.net api - C#