People seem to really wiggle around what constitutes state, when it comes to auth/autz and REST. Some people seem happy with a tiny amount of state to manage u

People seem to really wiggle around what constitutes state, when it comes to auth/autz and REST. Some people seem happy with a tiny amount of state to manage user sessions, which makes REST harder. Other people use tokens of one flavor or another, which may have more security vulnerabilities than conventional sessions, although I'm not convinced. Shared secret HMAC style is another alternative, although I'm not clear how to make that work with javascript clients in browsers. Some people just throw the whole authentication question into headers and do basic auth.