Indeed, this is the point I wanted to get to.<p>If you have to do a challenge-response auth every 5 requests, or so, to get a session, then it’s not really rest.<p>Client certificates might actually make the most sense in this case.