From 3fd8416ab8798daf7f810c1956b2110311721dc5 Mon Sep 17 00:00:00 2001
From: Tom MacWright <tom@macwright.org>
Date: Mon, 19 Nov 2012 11:31:24 -0500
Subject: [PATCH] More notes

---
 NOTES.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/NOTES.md b/NOTES.md
index 33adadc50..20c6ef848 100644
--- a/NOTES.md
+++ b/NOTES.md
@@ -184,3 +184,16 @@ See:
 
 * [getComputedTextLength](http://www.w3.org/TR/SVG/text.html#__svg__SVGTextContentElement__getComputedTextLength)
 * [getTotalLength](http://www.w3.org/TR/SVG/paths.html#__svg__SVGPathElement__getTotalLength)
+
+## Authenticating
+
+The [OAuth](http://oauth.net/) endpoint of OpenStreetMap does support
+[CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing),
+which is great and allows iD to do browser-side authentication. This requires some hacks,
+mainly that a cookie is used to persist the token_secret between pageloads.
+
+## Making Edits
+
+    PUT /api/0.6/changeset/create
+    POST /api/0.6/changeset/135324/upload
+    PUT /api/0.6/changeset/135324/close