Which one is the best authentication approach for an Web API, considering that the data security is essential and the ASP.NET application runs on Azure?