Ask HN: What's the recommended method of adding authentication to a REST API?