Websockets for Embedded Application
I recently did a similar design for fun with an iphone sending http requests to a webserver running on a MSP430.  I also looked a little at security.  I think if you want to make your project "more secure and not easy to hack" then you should look into encrypting whatever communication channel you are using.  I'm sure you could encrypt the payload you send from the android phone, and decrypt on your endpoint.

The problem I hit was the code to support something like https key negotiating was way too big for my little device.  I ended up going with their built in AES encryption engine, and just sharing the keys between the devices ahead of time.

In any event that's where I would start, once you can encrypt your payload, your transport mechanism starts to matter less and less.