How I've done it is something like this: (1) Client sends auth info to backend server (2) Server sets auth cookie on client (3) Every request goes through a

How I've done it is something like this: (1) Client sends auth info to backend server (2) Server sets auth cookie on client (3) Every request goes through a proxy written in Ruby/EventMachine which either just passes through the request to the backend server if requesting something public or first checks that the client's auth cookie is valid if its requesting protected resources. This certainly isn't as simple as it would be in a server-side framework, but otherwise it works pretty well.