The idea of honest REST service is to allow easy communication with it to any client, even to the client that is not in a web browser: it could be mobile or desktop application or anything else. So, each request to the service must provide all necessary information to process that request. Keeping the state on server would complicate the task, because clients will not control it.
So, YES, ideally state must be held by clients. BUT, we need to understand clearly what we mean by "state". Because there are different kinds of state out there: Application state, and Resource state. I like the following article about the distinction.
P.S.
And BTW, keeping state in cookies would complicate life to clients as well(if they are not web-browsers).
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…