通过REST在Spring MVC中进行身份验证

我一直在寻找一种通过REST控制器(URL参数)对用户进行身份验证的方法.
与此最接近的事情是：

@Controller
@RequestMapping(value="/api/user")
public class UserController extends BaseJSONController{

    static Logger sLogger = Logger.getLogger(UserController.class);

    @RequestMapping(value = "/login",method = RequestMethod.POST)
    public @ResponseBody String login(@RequestParam(value="username") String user,@RequestParam(value="password") String pass) throws JSONException {
        Authentication userAuth = new UsernamePasswordAuthenticationToken(user,pass);
        MyCellebriteAuthenticationProvider MCAP = new MyCellebriteAuthenticationProvider();

        if (MCAP.authenticate(userAuth) == null){
            response.put("isOk",false);
        }
        else{
            SecurityContextHolder.getContext().setAuthentication(userAuth);
            response.put("isOk",true);
            response.put("token","1234");
        }
        return response.toString();
    }

}

但是,这不会创建cookie.
有什么想法或更好的方法来实现我想要实现的目标吗？