We could theoretically do either of those things. Nothing stopping us :p

Most systems I work with professionally are https + a secure token. New stuff will use this system so if you're playing on your phone on the way to work and open up your phone to play on your office wifi, you're still connected. Inside an app it would persist indefinitely based on the app login. Also, Google + Facebook logins will be configured -- I've already POC'ed that out locally for other work.

The key blocker is getting the game API-ified properly. After that it's just rebuilding pages and consuming the API. I'm hoping it can be a fall/winter project for myself and whoever else on the team has time. I've been ramping up on taking my web knowledge to extend it to a single codebase that handles web + android/ios app code seamlessly. The API is effectively just cleanup of the codebase.