JWT is an interesting standard (http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-1...) dealing with sessionless temporal auth tokens that offers some flexibility between http basic (native) or signed tokens using the same credentials. If you're not using TLS you're kind of screwed anyway, whatever the auth scheme!