So I worked out how to do point 2.
Before requesting any HTML content you need to hit the endpoint {{root}}/oauth2/login/ with the auth token that you provide to other endpoints. This will pass back a usable sessionid cookie that will let you access content that's not public (so long as the user has access).
As an aside, to pass the cookie through fetch() requests, I had to pass the option credentials: 'include'.
(I'm answering this on my stack exchange post as well - https://stackoverflow.com/questions/45978612/accessing-the-student-view-url-via-open-edx-api-authentication-or-alternatives/46159596#46159596)
I’m working on a React Native application where all the Edx course information needs to be displayed offline.
I’ve authenticated the app using oauth2 endpoint (`client_id=…&grant_type=password&username=user@example.com&password=p455w0rd` to `{{root}}/oauth2/access_token/`) and can access the API endpoints to get the users enrolled courses (`{{root}}/api/enrollment/v1/enrollment`) and the blocks within those courses (`{{root}}/api/courses/v1/blocks/?course_id={{course_id_url_friendly}}&depth=all&nav_depth=3&return_type=list&username={{username}}`). What I’m struggling to get is the contents of the HTML blocks.