Dominic Baier, who gave a great presentation on the security pipeline in WebAPI, has published his slides here and his source code here. Not going to say much else, but this is going to be a great help for us in getting our API secured.