SharePoint Hosted Apps is only about client-side: the cient authenticates directly against the server. There's no need for advanced authentication mechanism since there's no third-party involved.
oAuth, for instance, allows a third-party (the "provider" part in the case of a provider-hosted App) to "act as" the initial client: even if the request is from a completely random server on the net, SharePoint (kinda) sees it as if it was the client itself.
SP.RequestExecutor is more a CORS workaround than authentication. Authentication is not made at that API level, but is mostly handled by the browser.