This is very confusing to me. If you make this API call you get the _t cookie back which you can use. So just use that in your web view?
Or do you somehow have the master API key embedded in your app, if that is the case I would urge you to rethink this asap.