REST and Authentication
mbrubeck: The Amazon Web Services (AWS) authentication system is a good example.  It uses an HMAC sent in the request headers, so that each request is effectively signed by the sender:http://docs.amazonwebservices.com/AWSSimpleQueueService/2006...This allows authentication without any sort of server-side session state, since each request can be authenticated individually.  So it can be more horizontally scalable than a stateful session, but it may also be more CPU-intensive on both server and client, since they need to compute a cryptographic hash for every request.  Also, the lack of a widely-reviewed standard library for HTTP+HMAC authentication means that you might end up rolling your own, which would probably have security holes that you don't catch, like all the recent timing attack vulnerabilities:
http://news.ycombinator.com/item?id=760917