Restful authentication between two GAE apps

I am trying to write a RESTful Google app engine application (Python) that accepts requests only from another GAE that I wrote. I dont like any of the ways that I thought of getting this done, please advise if you know of something better than:

• Get SSL setup, and simply add the credentials on the request that my consuming app will send. I dont like it cause SSL will slow things down.

• Security by obsecurity. Add a random number in my request that is in Xmod0, where X is a secret number that both applications know. I just don't like this.

• Check the HTTP header to see where is the request coming from. This option is the one that I hate the least, not alot of processing, and spoofing an HTTP request is not really worth 开发者_C百科it, for my application's data.

Is there any other clean solution for this?

Use an HMAC. Embed the same secret in each app, and sign requests and responses using the HMAC. Don't forget to include nonces and timestamps to prevent replay attacks!