http://www.infoq.com/cn/news/2010/01/rest-api-authentication-schemeshttp://blog.joycode.com/demonfox/archive/2010/01/27/115864.joy