I would suggest using both SMS and HTTP. If the user is not signed in send their phone an SMS to notify them there's a message waiting.
That's how this Ericsson Labs service works: https://labs.ericsson.com/apis/mobile-java-push/
If you implement this yourself the tricky part is deleting the incoming SMS without the user seeing it. Or maybe it's ok if they see it in your case.
Looks like this works: Deleting SMS Using BroadCastReceiver - Android
Yes, writing code like this can be dangerous and you can potentially ruin someone's life because your application deleted an SMS it shouldn't have.