What does it mean for a REST API to be 'stateless', and what security implication does this have?

• A.Stateless means each response must carry all cached data needed to render it (no client-side storage); the security implication is that the server must sign every response with a session cookie, since the browser retains no memory of the previous page
• B.Stateless means the server stores no data of any kind (no database, no files); the security implication is that every secret must live in the client since the server retains no keys between calls
• C.Stateless means requests are processed in a fixed order (no parallel handling); the security implication is that all sessions are single-threaded, since the server tracks one client at a time
• D.Stateless means each request must contain all information needed to process it (no server-side session state); the security implication is that every request must include authentication credentials (token, API key) since the server retains no memory of previous authenticated requests