Light-weight verification of cryptographic API usage