Best way to access a database from a web app

Iam currently playing with play framework in java. And i want to develop a little program which provides the following:

1. login into website
2. do database querys as user and get this shown in html template
3. provide REST-Api backend for web app and other clients

No the following questions have raised:

1. Is it good to creat a REST-Api and let the web app call the rest urls instead of calling direct controller actions with direct database access? In this case i have to write the logic only in the rest api and not also in the web app.
2. How should i do the login with the rest api in backend? Normaly i would use the session to store the informations about the user. But with the rest backend i have to build something which works like Login<->REST-api checks for user and returns something??? The login has to work for the web app and also for other applications!
3. I also want to include some permission mangement, so that one user cannot call any function he wants. That would be hard without the rest api as backend, right?

Maybe you have a few more advices for me?