1-signin.js

// How you could do what you want in Ember

App.Router.map(function(){
  this.resource("userSession", function(){
    this.route("new", { path: "/sign-in" });
  })
});

// However, any time you create a resource you have an extra layer of routing
// & a model that you may/may not want. In the case of sign-in, which doesn't
// really represent part of the UI, I'd consider just using a route instead.

App.Router.map(function(){
  this.route("signIn", { path: "/sign-in" });
});

// Then in your controller you can set the current session on ApplicationController
App.SignInController = Ember.Controller.extend({
  signIn: function(){
    var session = UserSession.validate(this.get("username"), this.get("password")); // assuming you have some object with a session token or something
    this.controllers("application").set("session", sesssion);
  }
});

2-template.handlebars

<label>
  Email:
  {{view Ember.TextField valueBinding="username"}}
</label>

<label>
  Password:
  {{view Ember.TextField valueBinding="password" type="password"}}
</label>

<button {{action signIn}}>Sign In</button>

I think the biggest reason you're having a hard time is that it's a security risk. There cannot be any chance the user can disable the auth check and start getting protected data. I'm sure you've already considered those implications though :)

You are correct on the purpose of UserSession.validate. You have to be careful with cookies & ajax requests; I'm not sure how browsers handle cookies in ajax responses but I seem to remember it being a no-no in some; don't remember which. You could also just use document.cookies to set it manually in Javascript.

Also, not sure if you saw this but this looks like an interesting approach:

http://say26.com/using-rails-devise-with-ember-js