So how are developers supposed to build mobile apps that authenticate via Twitter? Same as your recommendation for websites: eg, do the auth server-side and ship custom tokens between client and server?
Seems even more of a kludge on mobile (html5) since most of the dev is pure Javascript, of course. This is really unfortunately in that it necessitates an active server connection for an app that might not otherwise need one at all.