What I've ended up doing is writing the REST backend and writing the presentation layer in something light, like flask or sinatra, just for session handling.
(1) Client sends auth info to backend server
(2) Server sets auth cookie on client
(3) Every request goes through a proxy written in Ruby/EventMachine which either just passes through the request to the backend server if requesting something public or first checks that the client's auth cookie is valid if its requesting protected resources.
This certainly isn't as simple as it would be in a server-side framework, but otherwise it works pretty well.
It's really a different paradigm and sometimes it can get really painful to move away from the way of thinking that we are used to.
My point was that I totally agree with the notion of a REST-based service, but it's easier from an implementation perspective to have have web-heads for views (static files, session handling, etc) that interact with the application (REST) server.