I am developing Restful API layer my app. The app would be used in premises where HTTPS support is not available. We need to support both web apps and mobile apps. We are using Node/Expressjs at the server side. My two concerns are:

* Is there a way we could setup secure authentication without HTTPS?
* Is there a way we could reuse the same authentication layer on both web app (backbonejs) and native mobile app (iOS)?