Andrew Haines

This is a great talk from RailsConf last year on the subject. And here's the PWA demo app he uses as an example.

I've built a couple of modest PWAs with Rails using these concepts.

You could do that initially. Although if you want to prevent users from hijacking the URL, you'll also need to protect your controllers by ensuring that the URL account_id always matches the current_user account ID. For example:

redirect_to root_path(script_name: "") unless current_user.account == Current.account