Then what's the point of having the [cookie authentication provider](https://github.com/Gizra/restful/blob/7.x-1.x/plugins/authentication/RestfulAuthenticationCookie.class.php)? Since it allows you to plug in –almost– the exact same code that there is here?

I still think that devs should be able to specify a list of authentication providers that was respected by Drupal. As a Drupal user you would expect to be logged by a cookie in your browser, that does not mean that is a best practise as an API user (specially if we are decoupling from Drupal).