I’m no security expert, just an app dev, but all persistent changes can only be made on the server. What happens on the browser in EmberJS is for the user’s convenience and superior usability experience, eg. caching for speed, automagic app-like interface behaviour. It doesn’t change the fact that ultimately it has to negotiate all persistent changes with the Rails server, and in doing so will only have permission to do so for the logged in user.
Same goes for all data retrieval - the rails server is only going to send out data the logged in user is privy to.
I don’t think you need to worry about this, because if anyone were to try to subvert this, they would fall at the first hurdle: there is no way to fool the API.
What is your concern?