What are the most critical mistakes teams make when trying to secure API endpoints against XML injection and parameter tampering?