非技术用户的轻量级身份验证方法，对于Ajax应用程序也是安全的？

I have a public-facing REST API, which uses django-rest-framework and Django 1.8. The API currently requires no authentication. As part of the same web application, on the same domain, I have a JavaScript front-end which consumes the API. I have a public-facing REST API, which uses dja