Which is probably why the school shut you down.
You are serving as a proxy for credentials into a system where the school is legally liable to protect the privacy of the students, families, and staff. Yeah. You get shut down NOW. It doesn't matter where your code is or how great your work is. you are taking control of something that they are required to protect.
If someone can hack iOS or your app and steal credentials, who's ass is on the line for discovering, disclosing, remediating, rebuilding trust, resigning, etc.? All those people have enough work without your app. They are responsible for what they create. They can't be responsible for your work. If they knowingly let it exist, they will have to take responsibility for any fallout that may come from it.
Who is going to be handling all the calls when people change their passwords at the site, but your app locks their accounts out by trying to use the cached credentials?
They have plenty to lose with your app. You are learning many things.
"All those people" are responsible for a public API; in this case, it is a text-based api over HTTP only, meant for human consumption, but it's an API nonetheless. This app does not bypass that API. If they don't like how the API is being used, they need to change it; but of course you can't close it completely. This is the analog hole of the Internet.
Web browsers are just a client for that particular kind of API. It's ridiculous to limit which clients can access an API, as long as they do so correctly. Of course, you can make it difficult or impossible for unapproved clients to access the API, that will achieve the goal; that's what DRM does. But by not putting those controls on the API you're allowing new competing clients to connect with it.
