Taking into account that phase 1 should enable the creation of a decent mobile viewer, I'd add one thing : requesting an authentication nonce. That way the app could link the user to the right web page ready to comment or do whatever, pre-authenticated.