I'd like to secure my (Java metro) webservice with a login.

Here's how I'm planning to do that:

Steps required when calling a webservice method are:

1. call login(user,pwd), receive a session token 1.1 remember the token
2. call servicemethod (token, arg1, arg2...)
3. webservice checks if the token is known, if not throw exception otherwise proceed
4. logout or timeout after x time periods of inactivity

my questions: 1. what's your opinion on this approach? does it make sense? 2. are there any libraries which take the burden of writing a session handling (maybe with database persistence to survive app restarts)

(the solution should be simple and easily usable with Java and .NET clients)

thanks!