Hi, 
what if the token expired for whatever reason?
Currently, if a REST call fails, an attempt to reacquire the token is made.
But in this case, the framework has to know the username and the password.

If you put only the session token, the username and the password will be null and this could be result in a NPE.
What if you, from here, call the protected onUserLogin() method passing at least a fake user/pass pair?