I've been given a directive from my companies architect NOT to return an array from a WebAPI becuase it is unsecure...pretty much anybody can see the data, and instead only return objects. Is this true? If so why?