Actually a good reason might be scalability. Authenticating every single request creates a big load on your authentication service. That's a lot of RPC's, particularly if you're using single sign-on and those RPC's are coming from every web app you run.