Are you familiar with the concept of coupling vs separation? I just read a blog post on this topic tonight by a developer/blogger here in town named Peter Williams. The relevant portion is under "Pardon me while I digress..." at http://barelyenough.org/blog/2009/04/instant-legacy-status/.

Anyway, it looks like you have taken some effort to separate data access and HTTP messaging into separate modules, which makes sense to me. Here I see a data access function which accepts HTTP messaging objects.  With the way you've written your data module, how many modules would you have to update if the authorization mechanism changed or if you swapped out your HTTP messaging library?