Point 6 (Sessions are Irrelevant) is really tricky. Fielding says much the same about sessions as this article but there's a lot of room for clarification.
Of course, there can be authentication and authorization but, really, there's no need for a session since you have to do those two on each http request anyway.