Mark O'Neill summarizes a talk he did at the recent RSA conference, on security for REST web services. He talks about "true" REST vs. how it is typically used:
... when people talk about a "REST style" Web Service, they usually mean a Web Service that presents a HTTP GET interface. This is very different from the original intent of REST, where GETs are only supposed to be used for fetching information, not for changing server state.
He then makes the point that security is easier to implement when only POSTs are using for changing server state.
The full set of slides from his talk (linked to from Mark's post) is worth a look.