AEM is REST based, does not have the concept of session which makes every request atomic. For accessing protected resources at time of successful login, Token authentication handler would issue a login-token cookie and subsequent authentication is based on login-token cookie. With this for all request credentials are not requested till expiry of cookie. Steps to configure the timeout for login-token is
Also make sure to set Token Length otherwise will throw exception "org.eclipse.jetty.servlet.ServletHandler / java.lang.IllegalArgumentException: Invalid token ''"