[arXiv] Enhancing REST API Fuzzing with Access Policy Violation Checks and Injection Attacks