So does this use cookie based authentication? Isn't there a more preferred way to do authentication in REST? (I'm actually trying to figure this out now)
It supports cookie auth for the browse-able web interface it makes available for APIs. It's optional though and it also supports HTTP auth and other auth styles as well I think.
It supports various types of authentication, including Django's standard session-based auth (which is useful if you're building AJAX clients to your Web API)