> sign their requests with some sort of token - which might as well be a cookie Using a token to sign requests is certainly a good idea, but you probably don'

> sign their requests with some sort of token - which might as well be a cookie Using a token to sign requests is certainly a good idea, but you probably don't want to pass the token around using a cookie, even over HTTPS. Many browsers don't enforce good cookie security and will transmit cookies in the clear if an attacker can redirect the browser to a non-HTTPS URL on the same domain.