In reply to John Teague.

@John Realy? Have you actually tried?

Google as probably the biggest provider of REST APIs has rate limiting on almost all of them which means that in practice you need to authenticate, which means in turn that your authentication credentials have to be available in the JS code, which means bye bye security.

I never heard of a mashup done on the browser side, but I will be glad to see a real life example to that. All mashups that I know of happen at server side.