I have to admit that this is my thoughts too, defensive and watchful, but no panacea. I'm interested primarily in mobile and web client accessing my own REST A

I have to admit that this is my thoughts too, defensive and watchful, but no panacea. I'm interested primarily in mobile and web client accessing my own REST API. Users have to be logged in to do anything anyway but it doesn't stop someone who has a valid login from writing another application and abusing the system. Like you said, you just need to be vigilant.