Point 6 (Sessions are Irrelevant) is really tricky. Fielding says much the same about sessions as this article but there's a lot of room for clarification.
My take on "sessions are irrelevant" is that you don't start and close a session. You start by creating a resource: itenerary, document, submission or whatever you call it. You do that by POST-ing to the list of such resources and you edit it (PUT) until you're done. You could always come back to it (GET) and edit some more (PUT). Or you could delete it (DELETE).
Of course, there can be authentication and authorization but, really, there's no need for a session since you have to do those two on each http request anyway.
http://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm