API Security: Race Condition