Oauth tokens don't have be in the header and I never put them in the header. Which service requires them to be in the header? Requiring parameters in a get post is the way to manage state in REST, isn't it? How else would you do it? REST does not allow for protected resources? Cookies are terrible because when you are using a programming environment that doesn't have cookie management for free you have to write values in the cookie format from scratch and work with headers when you don't have to do this with RESTlike applications that use OAUTH.