They shouldn't be logging in via the webview within the app anyway, so that's moot.

We are using cookies, as the post says, as a fallback authentication so devs can browse the API from a browser if they're logged in to the site.