diff --git a/ui/desktop/app/authenticators/password.js b/ui/desktop/app/authenticators/password.js
new file mode 100644
index 000000000..f9d97033e
--- /dev/null
+++ b/ui/desktop/app/authenticators/password.js
@@ -0,0 +1,98 @@
+import BasePasswordAuthenticator from 'auth/authenticators/password';
+import { inject as service } from '@ember/service';
+
+/**
+ * A username/password authenticator that authenticates with
+ * a scope/auth-method endpoint.  Authentication occurs on an auth method
+ * endpoint, while deauthentication occurs on a scope endpoint.
+ */
+export default class PasswordAuthenticator extends BasePasswordAuthenticator {
+  // =services
+
+  @service store;
+
+  // =attributes
+
+  /**
+   * Generates an auth method URL with which to authenticate.
+   * @override
+   * @param {object} options
+   * @param {string} options.scope.scope_id
+   * @param {string} options.authMethod.id
+   * @return {string}
+   */
+  buildAuthEndpointURL({
+    scope: { id: scopeID },
+    authMethod: { id: authMethodID },
+  }) {
+    const adapter = this.store.adapterFor('application');
+    const options = { adapterOptions: { scopeID, method: 'authenticate' } };
+    return adapter.buildURL('auth-method', authMethodID, options, 'findRecord');
+  }
+
+  /**
+   * Generates a scope URL with which to deauthenticate.
+   * @override
+   * @param {object} options
+   * @param {string} scopeID
+   * @return {string}
+   */
+  buildDeauthEndpointURL({ scope: { id: scopeID } }) {
+    const adapter = this.store.adapterFor('application');
+    const options = { adapterOptions: { method: 'deauthenticate' } };
+    return adapter.buildURL('scope', scopeID, options, 'findRecord');
+  }
+
+  /**
+   * Generates an auth token validation URL used to check tokens on restoration.
+   * @override
+   * @param {string} tokenID
+   * @return {string}
+   */
+  buildTokenValidationEndpointURL(tokenID) {
+    const adapter = this.store.adapterFor('auth-token');
+    return adapter.buildURL('auth-token', tokenID, {}, 'findRecord');
+  }
+
+  /**
+   * Intercepts the authenticate response, if any, and assigns the returned
+   * token to all future requests via `addTokenToAuthorization`.
+   * Returns the response data as normal.
+   * @override
+   */
+  authenticate() {
+    return super.authenticate(...arguments).then((data) => {
+      const token = data?.token;
+      this.addTokenToAuthorization(token);
+      return data;
+    });
+  }
+
+  /**
+   * When restoring the session (say, on load), assigns the session token
+   * to all future requests via `addTokenToAuthorization`.
+   * @override
+   * @param {object} data
+   * @return {object}
+   */
+  restore(data) {
+    const token = data?.token;
+    this.addTokenToAuthorization(token);
+    return super.restore(data);
+  }
+
+  /**
+   * Assigns a token string all future requests via the `Authorization` header
+   * on the application adapter prototype.  Only application and adapters that
+   * extend the application adapter receive this header (which is most).
+   * @param {string} token
+   */
+  addTokenToAuthorization(token) {
+    const adapterPrototype = this.store.adapterFor('application').constructor
+      .prototype;
+    const headers = adapterPrototype?.headers;
+    if (!headers) adapterPrototype.headers = {};
+    adapterPrototype.headers.Authorization = null;
+    adapterPrototype.headers.Authorization = `Bearer ${token}`;
+  }
+}
diff --git a/ui/desktop/app/routes/application.js b/ui/desktop/app/routes/application.js
new file mode 100644
index 000000000..bdf072037
--- /dev/null
+++ b/ui/desktop/app/routes/application.js
@@ -0,0 +1,57 @@
+import Route from '@ember/routing/route';
+/* eslint-disable-next-line ember/no-mixins */
+import ApplicationRouteMixin from 'ember-simple-auth/mixins/application-route-mixin';
+import { inject as service } from '@ember/service';
+import { action } from '@ember/object';
+
+export default class ApplicationRoute extends Route.extend(
+  ApplicationRouteMixin
+) {
+
+  // =services
+
+  @service session;
+
+  // =attributes
+
+  routeIfUnauthenticated = 'index';
+
+  /**
+   * After becoming authenticated, does nothing.  This overrides the default
+   * behavior of the ApplicationRouteMixin, which is to redirect after auth.
+   * We'll handle this redirect manually in sub routes.
+   * @override
+   */
+  sessionAuthenticated() {
+    // no op
+  }
+
+  /**
+   * When the session ends, redirect to authenticate and reload the page to
+   * purge any in-memory state.
+   */
+  async sessionInvalidated() {
+    // Catch error in this transition, since it will be aborted by the
+    // scope auth route when it redirects to the first auth method.
+    await this.transitionTo(this.routeIfUnauthenticated).catch(() => {});
+    // The Ember way of accessing globals...
+    const document = getOwner(this).lookup('service:-document').documentElement;
+    // defaultView === window, but without using globals directly
+    const { location } = document.parentNode.defaultView;
+    // Wait a beat, then reload the page...
+    // This is mostly to give the deauth request a chance to fire.
+    /* istanbul ignore if */
+    if (!Ember.testing) later(location, location.reload, 150);
+  }
+
+  // =actions
+
+  /**
+   * Delegates invalidation to the session service.
+   */
+  @action
+  invalidateSession() {
+    this.session.invalidate();
+  }
+
+}
diff --git a/ui/desktop/app/session-stores/application.js b/ui/desktop/app/session-stores/application.js
new file mode 100644
index 000000000..b796add00
--- /dev/null
+++ b/ui/desktop/app/session-stores/application.js
@@ -0,0 +1,3 @@
+import LocalStorageSessionStore from 'auth/session-stores/local-storage';
+
+export default class ApplicationSessionStore extends LocalStorageSessionStore {}
diff --git a/ui/desktop/package.json b/ui/desktop/package.json
index 793d4a132..6876e906f 100644
--- a/ui/desktop/package.json
+++ b/ui/desktop/package.json
@@ -66,6 +66,7 @@
     "ember-page-title": "^6.0.3",
     "ember-qunit": "^4.6.0",
     "ember-resolver": "^8.0.0",
+    "ember-simple-auth": "^3.0.1",
     "ember-source": "~3.20.2",
     "ember-template-lint": "^2.9.1",
     "ember-welcome-page": "^4.0.0",
diff --git a/ui/desktop/tests/unit/authenticators/password-test.js b/ui/desktop/tests/unit/authenticators/password-test.js
new file mode 100644
index 000000000..0314aed17
--- /dev/null
+++ b/ui/desktop/tests/unit/authenticators/password-test.js
@@ -0,0 +1,50 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
+import { Response } from 'miragejs';
+
+module('Unit | Authenticator | password', function (hooks) {
+  setupTest(hooks);
+  setupMirage(hooks);
+
+  let store;
+  let applicationAdapter;
+  let session;
+  let authenticator;
+
+  hooks.beforeEach(function () {
+    store = this.owner.lookup('service:store');
+    applicationAdapter = store.adapterFor('application');
+    session = this.owner.lookup('service:session');
+    authenticator = this.owner.lookup('authenticator:password');
+    session.invalidate();
+  });
+
+  hooks.afterEach(function () {
+    session.invalidate();
+  });
+
+  test('it adds an authorization header to application adapter on restore', async function (assert) {
+    assert.expect(1);
+    const mockData = { id: 'token1234', token: 'token1234' };
+    this.server.get(authenticator.buildTokenValidationEndpointURL(mockData.id), () => {
+      return new Response(200);
+    });
+    authenticator.restore(mockData);
+    assert.equal(applicationAdapter.headers.Authorization, 'Bearer token1234');
+  });
+
+  test('it adds an authorization header to application adapter on authenticate', async function (assert) {
+    assert.expect(1);
+    const creds = { identification: 'foo', password: 'bar' };
+    const scope = { id: 'global' };
+    const authMethod = { id: 'paum_1234' };
+    this.server.create('scope', { id: 'global', type: 'global' });
+    this.server.create('auth-method', { id: authMethod.id, scopeId: 'global' });
+    await authenticator.authenticate(creds, null, { scope, authMethod });
+    assert.equal(
+      applicationAdapter.headers.Authorization,
+      'Bearer thetokenstring'
+    );
+  });
+});
diff --git a/ui/desktop/tests/unit/routes/application-test.js b/ui/desktop/tests/unit/routes/application-test.js
new file mode 100644
index 000000000..21e9fb300
--- /dev/null
+++ b/ui/desktop/tests/unit/routes/application-test.js
@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Route | application', function(hooks) {
+  setupTest(hooks);
+
+  test('it exists', function(assert) {
+    let route = this.owner.lookup('route:application');
+    assert.ok(route);
+  });
+});
diff --git a/yarn.lock b/yarn.lock
index 2f648ed98..0b34487e5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7523,7 +7523,7 @@ debug@~4.1.0:
   dependencies:
     ms "^2.1.1"
 
-debuglog@^1.0.1:
+debuglog@*, debuglog@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492"
   integrity sha1-qiT/uaw9+aI1GDfPstJ5NgzXhJI=
@@ -9157,7 +9157,7 @@ ember-router-generator@^2.0.0:
     "@babel/traverse" "^7.4.5"
     recast "^0.18.1"
 
-ember-simple-auth@^3.0.0:
+ember-simple-auth@^3.0.0, ember-simple-auth@^3.0.1:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/ember-simple-auth/-/ember-simple-auth-3.0.1.tgz#78bcd8e3d04da43154cf105931c0d3620a9f0694"
   integrity sha512-7D5s23nA5Nsonf37CyeQtksadV6Rgiz2rgCgRDnUObp3xnV71ljPtaUcZuq6kqqaZANYJi3uM8i4zVzmAHlKFQ==
@@ -12229,7 +12229,7 @@ import-lazy@^2.1.0:
   resolved "https://registry.yarnpkg.com/import-lazy/-/import-lazy-2.1.0.tgz#05698e3d45c88e8d7e9d92cb0584e77f096f3e43"
   integrity sha1-BWmOPUXIjo1+nZLLBYTnfwlvPkM=
 
-imurmurhash@^0.1.4:
+imurmurhash@*, imurmurhash@^0.1.4:
   version "0.1.4"
   resolved "https://registry.yarnpkg.com/imurmurhash/-/imurmurhash-0.1.4.tgz#9218b9b2b928a238b13dc4fb6b6d576f231453ea"
   integrity sha1-khi5srkoojixPcT7a21XbyMUU+o=
@@ -13931,6 +13931,11 @@ lodash._baseflatten@^3.0.0:
     lodash.isarguments "^3.0.0"
     lodash.isarray "^3.0.0"
 
+lodash._baseindexof@*:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/lodash._baseindexof/-/lodash._baseindexof-3.1.0.tgz#fe52b53a1c6761e42618d654e4a25789ed61822c"
+  integrity sha1-/lK1OhxnYeQmGNZU5KJXie1hgiw=
+
 lodash._baseuniq@~4.6.0:
   version "4.6.0"
   resolved "https://registry.yarnpkg.com/lodash._baseuniq/-/lodash._baseuniq-4.6.0.tgz#0ebb44e456814af7905c6212fa2c9b2d51b841e8"
@@ -13939,11 +13944,16 @@ lodash._baseuniq@~4.6.0:
     lodash._createset "~4.0.0"
     lodash._root "~3.0.0"
 
-lodash._bindcallback@^3.0.0:
+lodash._bindcallback@*, lodash._bindcallback@^3.0.0:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/lodash._bindcallback/-/lodash._bindcallback-3.0.1.tgz#e531c27644cf8b57a99e17ed95b35c748789392e"
   integrity sha1-5THCdkTPi1epnhftlbNcdIeJOS4=
 
+lodash._cacheindexof@*:
+  version "3.0.2"
+  resolved "https://registry.yarnpkg.com/lodash._cacheindexof/-/lodash._cacheindexof-3.0.2.tgz#3dc69ac82498d2ee5e3ce56091bafd2adc7bde92"
+  integrity sha1-PcaayCSY0u5ePOVgkbr9Ktx73pI=
+
 lodash._createassigner@^3.0.0:
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/lodash._createassigner/-/lodash._createassigner-3.1.1.tgz#838a5bae2fdaca63ac22dee8e19fa4e6d6970b11"
@@ -13953,12 +13963,19 @@ lodash._createassigner@^3.0.0:
     lodash._isiterateecall "^3.0.0"
     lodash.restparam "^3.0.0"
 
+lodash._createcache@*:
+  version "3.1.2"
+  resolved "https://registry.yarnpkg.com/lodash._createcache/-/lodash._createcache-3.1.2.tgz#56d6a064017625e79ebca6b8018e17440bdcf093"
+  integrity sha1-VtagZAF2JeeevKa4AY4XRAvc8JM=
+  dependencies:
+    lodash._getnative "^3.0.0"
+
 lodash._createset@~4.0.0:
   version "4.0.3"
   resolved "https://registry.yarnpkg.com/lodash._createset/-/lodash._createset-4.0.3.tgz#0f4659fbb09d75194fa9e2b88a6644d363c9fe26"
   integrity sha1-D0ZZ+7CddRlPqeK4imZE02PJ/iY=
 
-lodash._getnative@^3.0.0:
+lodash._getnative@*, lodash._getnative@^3.0.0:
   version "3.9.1"
   resolved "https://registry.yarnpkg.com/lodash._getnative/-/lodash._getnative-3.9.1.tgz#570bc7dede46d61cdcde687d65d3eecbaa3aaff5"
   integrity sha1-VwvH3t5G1hzc3mh9ZdPuy6o6r/U=
@@ -14171,7 +14188,7 @@ lodash.pick@^4.4.0:
   resolved "https://registry.yarnpkg.com/lodash.pick/-/lodash.pick-4.4.0.tgz#52f05610fff9ded422611441ed1fc123a03001b3"
   integrity sha1-UvBWEP/53tQiYRRB7R/BI6AwAbM=
 
-lodash.restparam@^3.0.0:
+lodash.restparam@*, lodash.restparam@^3.0.0:
   version "3.6.1"
   resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805"
   integrity sha1-k2pOMJ7zMKdkXtQUWYbIWuWyCAU=