What Okta Bcrypt incident can teach us about designing better APIs