So, Ii'm building an external app and wish to communicate with Netsuite via tokens.  So far, things have gone fairly smooth (lots of trial and error, but I've got token-based communication with RESTlets working).  Last step is end-user authentication.  My hope was to allow the end-user a traditional login screen with email/password.  Take those values and create the NLAuth in the Authorization Header and send a GET request to https://rest.netsuite.com/rest/issuetoken (and yes, its the correct URL).  I know all my values (email/password/consumerkey) are correct, becuase I'm using them for my other calls.