Data save/update/exchange for an online mobile game

Hi all, though it is still an early stage for my development, but I would like to have some idea on some foreseeable issue so that I could perhaps design a better coding infrastructure....

so..I would be writing a online game, which is not an MMO, but simply a game that player need to connect to a server, probably for save updates and status monitoring, as it will be a free-to-play game providing IAP.

meanwhile, I may go for SOOMLA for the IAP module, and probably PARSE or KII for the server side host, as I would need a database as well as server side logic supported.. any comments or suggestions??

my concern are listed as below:

1. I know it is impossible to fully prevent hacking and reverse engineering, but after some researches, I got an idea that I could store the player save at the server-side and load it whenever the player start the client app, but how could that be actually done? I got confused as we need login id/password to access the server, though I know i should get the login-code to be written at server-side (i.e. php) and call the php by WWW in unity, but how could I prevent the call from being an application apart from my original app?

2. there would be patches and probably event updates in the future, which may not require updating the codes/logic, and therefore I may need to update only some data files like images or level settings, how could I check for the updates? (perhaps some versioning or file list?)

3. furthermore, where should I store the above data? I know the resources assets will be built in a file, and I wonder if I should go for the persistentdata or streamingAssets... where should I exactly place the data directory if I am developing for both android and iphone?

sorry that I have no experience in developing online game with security issue, and therefore the above problems may be a bit amateur .... hope someone could guide and help me out, thanks in advance!! :)