title: Asp.Net MVC 3 Secure Login
body: <p>I have Asp.Net MVC 3 site that has SSL on entire site.
  I do have Login action on controller that accepts userName and password and returns Token that is user for calling other actions in web application.In background that actions calls my REST api.</p>
  
  <p>How can I be sure that valid user will not go to my website, login and after that use Fiddler to extract Token?
  After that he will be able to call my REST api using that token to do some malicious stuff...</p>