So, answering your question, the local storage issue is still a valid concern as it is a feature of the Web View component used by these frameworks (PhoneGap, Cordova, Ionic and the like) to make the UI.
Additionaly, all those requests that carry identification/secret elements (Session ID, Refresh Token, etc.) should be made through HTTPS, preventing malicious observers from knowing their values.
Secure flag to those cookies, to avoid sending them through not encrypted connections.
And Please, if you use encrypted connections, do not make it accept any certificate. Be sure to verify correctly the validness of the cert provided by the server.
Instead of disabling the check or making it return 'true' for any certificate, the secure solution to self-signed certificates is pinning the one you generated or adding the CA used to create your certificate to the list of trusted CA's.
To help you further in your quest for securing your mobile app comunication:
OWASP document explaining Certificate Pinning
Page talking about the pros and cons and providing links and an example
SE question about Certificate Pinning
From what i could understand, this is an incorrect behavior created by the framework implementation. Long answer short: "It should be possible, but we screwed things up." I tried developing test apps for phonegap, but found (implementation) errors like this one that made me give up and come back to native Android. That said, i would like you to please upvote my answer back to zero, as it should be right because your application is not native as you said, but unfortunately wasn't able to solve the problem because of phonegap's way of doing things.