Cross-domain login

I need to perform authentication from a (non-Drupal) web application to Drupal in order to subsequently load, using Ajax requests to the REST service, some data that is only available for authenticated users.

As my application runs on another domain/port, the Same Origin Policy applies and I cannot make standard AJAX requests. The most appropriate way forward seems to either use JSONP AJAX requests, or wait until the issue "The OPTIONS request method and preflighting cross domain requests" has been resolved.

For the first approach of using JSONP, I can only make GET requests (by the nature of JSONP, POST seems not possible). – And here comes the problem: the 'user' resource of the Services module only provides a 'login' action using POST. Is there a way to circumvent this? Do actions need to be POST?

I suppose that authentication from external web applications to Drupal is going to be a frequent use case so I am wondering how to best approach this. Many thanks for any pointers.

Kaspar