Thank you for the follow up Gregor and hope you are able to find another solution that gives you control to add the headers needed.
All the modern mobile OSes seem to require all of the added security which makes sense but makes this more complicated. As an aside, we do now have an OpenThings Cloud that might help with this and provide SSL between the app and our server.
Thanks and best wishes!