The use case that motivates my feature request is Omniauth authentication with Devise. In this scenario, the user clicks for example on "Sign in with Google", this redirects the user to the Oauth service of Google. When the user gives permission the user is redirected back to the original application where he is signed in. All those previous steps have created a user with authorization token in the server but the Ember application is no even loaded. At this point I redirect the user to the Ember application with url-authentication and the new authentication token and Ember-auth does a sign in. This works well but when the user comes back to the application, all the process has to be repeated because there is no option for url-authentication to perform sign-in + remember-me. I think it is more natural for Oauth users to use remember me because otherwise they always have to go through the process.

Here's an actual implementation of that: https://starter-app.herokuapp.com/users/auth/google_oauth2

An additional reason for remember me is that when url-authentication is used, the authentication token is left on the url visible forever. This is a small security concern. a brute force solution for that would be to reload the page with remember me enabled to get the token out of sight and still have the user signed in. Another option could be to allow for the auth token to be passed in the http header. This wouldn't be useful for the original scenario of confirmation emails but for server based Oauth authentication I think it would make even more sense. What would you think of url-authentication being able to get the authorization token from the headers as well?