With a mobile app - it is different I guess in that the credentials are probably staying on the mobile device - they just need to do the proxying on the client - it seems.

I don't have an Iphone to test - if someone has Charles or some other proxy to see where the requests are going, I'd be interested to hear.