Your second scenario relies upon credential caching, or "saved logins", and is just as doable for an HTML5 app as it is for a client app.

Facebook still has credentials (vs. some apps that are tied to just the phone number or native Google account tied to the phone) and as such, still requires a login for that initial run, just as an HTML5 app does.

In that regard, it's possible that the non-Facebook app has an advantage in that they can use Google oAuth to authenticate the user which, on an Android phone, already contains an active session, so their login method can be even leaner than the Facebook app (until and unless Facebook changes something, or releases their own hardware).