Ask HN: Best way to authenticate for RESTful service?

I'm building a server that allows users to control and access a web-connected sensor. The server lets the user connect to the device, change settings, and retrieve data that the sensor uploads.<p>All of the requests are stateless, so the the server does not have to maintain a session or any session state. I do however need to make sure that the user only accesses the devices and logs they are authorized to.<p>So my question is this: is it better to have every request be authenticated with the user's username and password, or should I still establish a session and use something like HMAC? What are the advantages and disadvantages of each approach?<p>Thanks!