it might be worth noting that basic auth is slightly worse than the others because it sends your password across in the clear for every request, whereas session

it might be worth noting that basic auth is slightly worse than the others because it sends your password across in the clear for every request, whereas session-based authentication is only sending it once. if i login to flickr at home and then go to a coffee shop a few days later, i'm never sending my password in the clear. of course, someone can steal my session cookie and be me, but they still won't have my actual password. with basic auth, i would have been giving my password out on every page view.