In point of fact is it viable to require OAuth for YAPI authentication, or is there a compelling reason to support other authentication mechanisms? If the latter, what else needs to be supported?

This is an open question; it is not directed specifically at denise.

Oh, and it would take a lot of persuasion to get me to spec support for plaintext username-and-password. Especially if it was going to be supported over plain HTTP (no TLS). But that should be obvious.