I had a related, followup question occur to me today.
In looking at the requests that the Moodle Mobile app makes for web services, there is a token parameter. Either as part of the post data, or as a get parameter.
For example in a request like this, the token parameter is part of the POST data:
A get request for the users icon, made by the Moodle Mobile app, looks like this:
A get request for a forum, made in the embedded browser, looks like this:
I wonder then if it would be possible to adjust the request so that it contained the token. Perhaps something like this:
That way an auth plugin could see if there is a token and if possible use that to undertake authentication / authorisation.
Granted in the example the parameter 'token' is a bit generic and could be mistaken by a plugin for one of its parameters, perhaps it could be called something like mmtoken.