@RestResource(urlMapping='/restlead/*')
global with sharing class RestLeadReceiver {

    @HttpGet
    global static String init() {
        String payload = ' -d "grant_type=password"' +
            ' -d "client_id=someID"' +
            ' -d "client_secret=someSecret"' +
            ' -d "username=email@here.com"' +
            ' -d "password=passwordTOKEN"';

        HttpRequest req = new HttpRequest();
        req.setMethod('GET');
        req.setEndpoint('https://login.salesforce.com/services/oauth2/token');
        req.setHeader('Content-Type','application/x-www-form-urlencoded');
        req.setHeader('Content-Length', String.valueOf(payload.length()));
        req.setHeader('X-PrettyPrint', '1');
        req.setBody(payload);

        Http binding = new Http();
        HttpResponse res = binding.send(req);

        System.debug(String.valueOf(res));

        return String.valueOf(res);
    }

    global static String addTask() {
        RestRequest request = RestContext.request;
        request.addHeader('Authorization', 'Bearer ' + SESSION_ID_FROM_INIT);
        String leadID = request.requestURI.substring(request.requestURI.lastIndexOf('/') + 1);
        Lead l = [SELECT Id FROM Lead WHERE Id=:leadId];
        return l;
    }
}

[{"message":"Session expired or invalid","errorCode":"INVALID_SESSION_ID"}]