Authenticating REST requests from a headless front end

Great point. I had not considered the angle you raised in the second paragraph — it reframes the whole thing for me.

Could you say more about how you measured the result? I want to try this but I am not sure what success would look like.

This matches my experience exactly. The hard part is staying consistent once the initial novelty wears off.

Thanks for writing this up. Bookmarking it — the kind of thing I will want to reference again in a month.