Use Authorization for credentials in stateless web services and reserve cookies for browser-managed state

16dfb11c-d1cd-49e6-93d9-a8c7cef1b52d