SSO implementation for Mobile Apps

The current login App will take a username and password and send it to a Security Shepherd Web instance, if these credentials exist in the database, the Web App will respond with a JSON object containing a session ID and a CSRF token.

1. The Login App needs to take these values and store them in a Content Provider. This will allow all other Apps with the Content Provider's URI to access the session value. The URL for the Security Shepherd web app also needs to be stored for other Apps to reference when performing network operations.
2. Upon opening any of the vulnerable apps, if the session value is empty or invalid, the user is informed that they need to login and they will be redirected to the Mobile Login.
3. Where relevant, upon completing a mobile lesson/challenge, the key is taken from the web server using the users session ID. Ensuring keys are no longer the same for every user.

Start by tracing the mobile Login App flow described in the issue, then identify the vulnerable apps and lesson/challenge completion paths that use session data. Done means shared session and web-app URL storage, login redirection for empty or invalid sessions, and per-user challenge keys are implemented across the relevant mobile apps.