I am working on an AngularJS mobile application that obtains its data from salesforce.com using REST calls to @RestResource Apex classes. (There are no conventional Visualforce/Apex controller pages.) This works fine when the Apex classes are exposed in an unauthenticated manner through a site.
However, the intention is that users (customers) will be able to self-register and that their access will be secured through the User created via Site.createPortalUser. Some testing and Googling suggests that the corresponding Site.login has no affect when invoked from a @RestResource class.
An alternate approach appears to be to make use of the Username-Password OAuth Authentication Flow and I am encouraged about using this for sites by this OAuth for Portal Users blog. But the first link says that the security token must be appended to the password and I don't see how this token can be obtained for a portal user. And if it could it would be very hard for the user to enter. (That difficulty would seem to make it inappropriate for any type of interactive user.)