There's no reason why they can't have the native portion do the authentication and just have it return a signed token to the JS portion which forwards it to the

There's no reason why they can't have the native portion do the authentication and just have it return a signed token to the JS portion which forwards it to the server.