Subbu Allamaraju, an engineer with experience at Yahoo and eBay, writes about APIs, cloud infrastructure, engineering leadership, and career.
One commenter calls him the proponent of REST who speaks the most sense; others link his posts on Node.js vs Play and API pain.
This will go into detail far more than I can in a post. http://www.subbu.org/blog/2008/04/nouns-and-resources but the tl;dr is REST nouns are a construct in which you identify all of your objects in a system, these become your REST endpoints such as User in which you have GET, POST, PUT, DELETE each of these verbs causing a specific action on the object or noun. This works great for a large portion of the application but there are some areas such as transactions where it is very hard to logically turn the action into a noun and make it understandable. Sometimes we need the back end to orchestrate multi-step actions and the noun construct just does not convey the workflow. When this happens some people choose to use verb systematic such as generatePDF while still maintaining the REST HTTP actions while others tend to strictly adhere to making said process a noun which can effect readability.
Subbu Allamaraju (ex-Yahoo, now eBay) has been the one proponent of REST that I believe speaks the most sense.
He understands that most "RESTful" APIs out there leave HATEOS as an afterthought, but he doesn't believe there is such a thing as a 100% RESTful API - you match the architectural style to the context of the problem you are trying to solve.
http://www.subbu.org/
Ah, looks like this is the library Subbu Allamaraju refers to at http://www.subbu.org/blog/2011/11/apis-are-a-pain--the aim of ql.io is to alleviate the challenges of "aggregation, parallelization, and orchestration of forks and joins." (i.e. in practice, "consistent RESTful APIs don’t matter as much as we think," nice though they may be.)
OAuth is an authentication mechanism, meaning it implements a principle of logic stating that a subject is who he/she claims to be (authN), and then asserts that to a relying party (authR). In other words, OAuth establishes identity.
Your question about MITM is answered at http://www.subbu.org/blog/2010/09/oauth-2-0-and-cookie-convergence.
Point well taken - there was no such intention. I updated the charts to show req/sec and mean response time separately. See http://www.subbu.org/blog/2011/03/nodejs-vs-play-for-front-end-apps