What are the most common mistakes developers make when securing API endpoints against injection attacks in modern web apps?