Those are three very loaded sentences ??? keep an eye to see if the candidate remembers to track the redirects, if he or she thinks about authenticating the API calls from your web service, and other things that aren???t obviously spelled out but an experienced hacker would know to think about.