I'm a bit of a newbie when it comes to security and authentication and most other client-server communication stuff. What I'm trying to do is simple, and if possible, avoid having to bring in 3rd party frameworks and classes to do the job. (I'm using Google App Engine with Python)

A user logs in to the service once via a mobile application (iOS). Once logged in, the user will make many requests, to get things such as messages, friends, statuses, etc. So each time the app talks to the server, rather than sending that user's email and password to authenticate, we'll send a session id. So far, that was just my understanding of the system. 

I've come up with an extremely simple approach, which to me seems like it will work just fine, but being inexperienced I'm probably not seeing many things. What would be wrong with doing this:

1. on device, user types in email/password, the credentials are sent to the server and verified, and once authenticated, a random number is generated. This random number is stored as an IntegerProperty on the User model with the name session\_number.
2. the session\_number is sent to the user's device and is saved. Now, anytime the user connects to the server for a request, the session\_number **along with** the user's integer id number are sent to the server. We get the User entity for that userId, and now we compare the value of user.session\_number == incoming\_session\_number. If they match, we're good, else error.
3. If the user logs out, we clear the session\_number from the data store.

The only other question here is how would this be handled when the user is logged in from multiple devices? Should each device store its own session\_number?