title: REST authentication and exposing the API key
body: <p>I've been reading up on REST and there are a lot of questions on SO about it, as well as on a lot of other sites and blogs.  Though I've never seen this specific question asked...for some reason, I can't wrap my mind around this concept...</p>
  
  <p>If I'm building a RESTful API, and I want to secure it, one of the methods I've seen is to use a security token.  When I've used other APIs, there's been a token and a shared secret...makes sense.  What I don't understand is, requests to a rest service operation are being made through javascript (XHR/Ajax), what is to prevent someone from sniffing that out with something simple like FireBug (or "view source" in the browser) and copying the API key, and then impersonating that person using the key and secret?</p>