Following Nick's excellent blog article at: http://blog.notdot.net/2010/05/Authenticating-against-App-Engine-from-an-Android-app and with the changes I had made previously, I am now able to use the Android AccountManager and Restlet's GaeAuthenticator to require authentication to access the API uris.
Now time to throw it away and replace it with oAuth2 :). RB ------------------------------------------------------ http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2964176