I think that removing the token form the url would be enough for now given that important improvements on Ember.js are still undecided. Maybe when all is more stable, the token can also be added to the header which I think is safer.

You are right regarding the URL callback in OAuth. If there was a way to specify that url-authentications should include remember me by default then the rememberKey parameter wouldn't be needed. How would this be? Should that be modifying the Auth.conf parameters like that?: urlAuthentication: [no, yes, remember] or urlAuthRemember: true
This last is a little bit less flexible because affects all urlAuthentications be it email or any other but it would do the trick as well.

Any of the two approaches is good for me. Either rememberKey or some modified setting in Auth.conf. I can adapt the PR to what is better.