You can also just use Basic auth and get an Authentication header sent with every request. You know, what auth systems should have been using all along.