Use ASP.NET MVC's AntiResourceForgery token mechanism and extend it to Web API via a delegating handler to prevent CSRF attacks ...