following on bmeltons question, the user must still log in, so the username / password is only entered once and this token is then returned? What about session expiration, how is that determined, and what about a user logging on from different devices - a token for each device ?