android - Using GCM to make a secure chat application -

i'm trying make chat application using gcm, i'm little confused best practices are.

the tutorials i've seen recommend using xmpp-protocol because can use existing connections , pass bi-directional messages makes faster. problem gcm payload limited 4kb. wonder whether it's safer use push notifications deliver messages or notify clients there more messages download using http-protocol.

there security problem. use oauth resource owner flow secure many of http-endpoints. feels bad include client-id, user-id , access-token/refresh-token in gcm upstream messages since payload limited. also, require me write lot of code ensuring access-token has not expired , when retry , include refresh-token instead , on. wonder if it's better send upstream messages using http-protocol , using gcm notify receiver download message. lastly, wonder if it's worth using xmpp-protocol if using http upstream messages anyway. xmpp-protocol still faster, or faster if going use send upstream-messages?

hope able explain problem well.