Direct object references in web services