Having to do an authentication check on every request is suboptimal, but ok in many cases. It's just very unfortunate that more protocol explicitly directing secure interactions between the user and the user-agent in managing identity and authentication never really emerged.