Open Stack

I originally wrote that the Trusts API was going to use the 
Authenticate  call (HTTP POST to   /tokens)  to get a token for the 
trust, but the more I think about it, the less I like this.  We have 
already overloaded that call with too many different ways to get a token.

It would not  be proper instead to use:

GET /trusts/{trustid}/token

To get a token for a trust, GET is supposed to be idempotent.   It seems 
like it should be a POST verb, as we are getting back a new object.  
Thus would

POST /trusts/{trustid}/token

Make more sense?  I can see an argument that getting a token should be 
under the token router and controller.  Thus maybe:

POST /token/trusts/{trustid}

Would be the right action and URL?  Any Feedback?