Hmm, would storing the session ID locally really be that bad security wise? This will all be in app so URLs wont be visible to the user.
Security is a fickle thing, over time I have come to look at it with : "What's there to steal, or take"
If you have a simple game with no payment or purchase options, then, what's the worst they could do with the information ?
Personally, if I were to retrieve information from a database, I wouldn't even use the session ID, and simply create a log in system over PHP and Ajax. This also isn't as secure as I'd like, but it's more standard, and gives me more options to somewhat secure my information.