Web services security takes shape