I have created an Android App that communicates with a PHP web server. They both send JSON to each other. My App is almost finished, however there is one thing left to do: authentication.

Since the user's username and password will be stored in Android SharedPreferences, is there any need to use PHP sessions, given that the user won't need to enter the username/password at every request?

Since I can just send the username and password in the HTTP POST header for every request, and that I will be using SSL, is this sufficient? I guess I could add an extra field in the header called 'random' that just adds a random value, just to use as a salt so that the encrypted SSL payload will be different everytime.

The reason why I don't want to use sessions is that my Android App would either have to handle cookies, or managed the storage of the session ID.

If there are some serious cons to using my method above, then I'm more than happy to use sessions, however all advice is appreciated.

Thanks