Nice summary (even if I have some trouble accepting stateful auth as being RESTful...:)

One thing (perhaps rightfully) missing is auth in the tls/ssl layer. Client certs do work, pre-shared keys sadly do not really work. And I don't know what happened with tls-srp:

https://bugzilla.mozilla.org/show_bug.cgi?id=405155