I'm looking for different ways to authenticate the Liferay 7.0 JSON web services exposed to be used from a mobile app. Not interested in the Basic Auth. Please attach any references to look into detail regarding these mechanisms.
 

Does this mechanism give me the possibility to get the user session in the JSON web service controllers?
Can I force session timeout the user (or token expiry)?
  
Thanks