If you are looking for ideas about security for REST web services then look at the OpenAuth spec Appendices describing the "handshake".
http://oauth.net/core/1.0/#anchor27
Creating web services that adhere to OpenAuth standards is probably one of the more secure ways that this can be done. It can give you ideas on authentication, authorization strategies.
The following is an example taken from the Authorization header in a GET or POST:
Authorization: OAuth
oauth_consumer_key="xxxxxxxxxxxx",
oauth_token="xxxxxxxxxxxx",
oauth_nonce="xxxxxxxxxxxx",
oauth_timestamp="1184242096",
oauth_signature_method="HMAC-SHA1",
oauth_version="1.0",
oauth_signature="xxxxxxxxxxxxxxxxxx"
I am not going to go into all the details of OpenAuth but essentially it allows a client to provide a consumer key that identifies the client, a token that identifies the user, and a signature that represents the Base64 encoded bytes of the encrypted signature to verify that the request has not been tampered or altered on transport.
Building the signature string typically involves the percent encoded combination of the entire request, parameters, as well as consumer key, token, nonce, and a consumer secret which the client should keep safe. Once this signature string has been built and percent encoded it can then by encrypted, and those encrypted bytes can be constructed into a Base64 encoded string that is included in the Authorization header.
If you perform this over SSL, then this is undoubtedly one of the most secure ways to handle authentication/authorization of a REST based web service.