Yeah, I think authentication and authorization are two of the hardest challenges in moving to a fully static app architecture. There're some more details in a talk I gave a few months ago (video: https://youtu.be/vHXcDKK4eGY?t=6822, slides: https://www.dropbox.com/s/uup4tgxyi7uybe0/API-Driven%20Devel...), and I'll be writing more (and hopefully open sourcing some code) in the future.
The upshot is we settled on OAuth 2.0 with JWT auth tokens, along with some custom DropWizard filters and annotations to enforce authz. We found two-legged OAuth 2.0 pretty straightforward to implement and use.