Member restricted game with API
The first 'problem' I notice is what I call a roocky mistake (been there, done that) is the way you route a request.

If a person requests ?page=mypage.php you check or that file exists if so, you include it.
this means that your filesystem is hardcoded with your routing. Everytime you change a file-name, your routes also change. Also, some file-systems are case-sensitive (oh oh!)

A better would be to have a Router script that handles routing, it recieves a request, and it simply calls the correct method. Routes can be stored in a database table, local file or even written in PHP (as in laravel)

Another thing that really bugs me is all the $_ variables in your code. A better thing to do is to wrap them somehow (e.g. a Class or a set of functions). These functions would then have some validation in them. E.g. CSRF protection when _POST data is given, or instead of using the default php session handler, have your own that stores all session data in a database, ...

You talk about MVC and that your php files are always a Model, controller and view in one. So you didn't use MVC, you simply started coding everything together. And that is simply not how you should begin.

When designing an API, make your own (web)-inteface use the same API as your smartphone-apps. This way, you only have to work on one single API instead of having an API for apps and a completly different one for the web.