title: Authentication Header for REST Service Token
body: <p>I'm building a REST Service that I want my users to be able to request a time-limited token by providing a username &amp; password, that they can use to make requests with (so they don't have to keep passing username &amp; password on each request).</p>
  
  <p>The site will run under HTTPS but I'm trying to figure where should the username and password be placed in the request when they ask for the token to keep it as secure as possible.  Would I be right to have it passed in through in the <code>Authorization</code> Header?  Would this be known as Basic Auth?</p>