Reference monitors for security and interoperability in OAuth 2.0