Called verify
Disabled session
Generate token at filter level. Add response header, X-Auth for token.
Refresh token when within expiration time