Open Stack

> P.S. the X-Subject-Token stuff is breaking HTTP; you need to either put the token (or a facsimile for it) in the URL, or put Vary: Subject-Token in EVERY response those resources generate. The former is preferred; this is over TLS, right? Sorry I didn't see that earlier.
> 
> P.P.S If it's not too late, drop the X- from that header! <http://tools.ietf.org/html/draft-ietf-appsawg-xdash-05>

Mark - could you open a bug against Keystone for the X-Subject-Token "breaking HTTP" with the relevant details?