Hi Daniel,
Thanks for the reply.
The key part here is the use of Xcode7.0.1 to build the ipa and run it iOS 9 device. Have you tested that? I don't think cordova is the cause.
When I used Xcode 6.4 with same cordova 5.2.0, no issue for iOS 9 device. So somehow, Xcode7 is doing something new iOS 9 security.
By the way, the url I used for my app is https://. So the TransportSecurity does not seem the cause either. I can launch the url in phone browser.
I am going to report to SAP.
Dong