I realized that we can start a task without storing username/password into vars.
A task can change state of item browsing URL openhab://?i=item&s=value
Tasks -> New -> Browser URL -> URL openhab://?i=item&s=value
The Android app has a build in Tasker integration for a while now.
You can also Choose items to control directly within tasks through the action category.
As Jermome indicates, you don’t need to use HTTP at all now and can interact with the openHAB Android app directly.
Use of Tasker excludes iOS by itself. Apple does not and will never allow an app that can do the sorts of things that Tasker can do. There are similar and much less capable apps on iOS but for the most part Apple doesn’t usually permit inter-app communication which would be require to support something like this.