First of all, I don't think you are copying anything from a software standpoint, because the implementation is all your own, the implementation of similar or exact ideas is all over the place and those that you have listed above is not a blatant copy.
Otherwise things like login is a blatant copying because it exist in almost all websites, and smartphones with touchscreen would have copied blatantly and the same goes for all fork and spoons all over the world. If there is any legality involved, one should get a copyright or patent. Only change something if you think it gives you more value or differentiate your app from another, don't change just because someone say so. You are just putting yourself in a disadvantage, because there are times, there are only limited ways to do something right.
In the case of item (1), allow me to enlighten you on the security aspect of that, if that is the intention of such a technique. It might not be true that because the mobile app is using a webview and that https is used and hence there is no chance of the mobile app from extracting the password entered by the user? I believe one could inject javascript into the webview after it is loaded in Android. I have read multiple articles that allow it. I also looked up the Android API and found the following "evaluateJavascript" method that will allow one to inject javascript, and correct me if I am wrong, but it does not forbid one from injecting into a HTTPS page.
That would means there is no need to prevent the mobile app from accessing the end-user's password in your own interface. You can opt to store or not depending on your wish, but the statement that the mobile app does not misuse the credential is just a made-believe statement, there is no technical barrier to prevent the mobile app from doing so using webview and https, only if the app is untampered with, in your case, it is your app, so you have the power to do so. All security bets are off, as long as the end points are compromised. Therefore I don't see the need for you to adhere to a false sense of security in your mobile app.
For better usability, you can use your native widget to collect the username and password, and invoke the https webrequest via a form submit in the background, there is no less security compared to the webview approach. You can choose to not store the username and password, only the token. You can also provide the "remember me" using native UI interface. This way your app can continue to access HWZ forum without enduser's credentials.
Have fun
.
