title: How to secure a REST API for mobile applications?
body: <p>I am trying to add a REST interface to Django for a mobile client.  The mobile client will use JSON over HTTPS.  I have not been able to find the "best" way to accomplish this for mobile devices.  From searching around, it seems that #2 is more favorable to #1: </p>
  
  <ol>
  <li>Use HTTP authentication and establish a cookie based session.  All transactions will occur over HTTP and JSON messages will only contain commands or data.</li>
  <li>Pass the username and password (encrypted) within each JSON msg for all transactions and do not rely on cookie-based sessions.</li>
  </ol>