I've come a long way in understanding session management in AEM since my post so I'll share what I learned. I should have stated this in my first post, that our requirement is to be able to set a session idle timeout (the user lets their browser sit for X minutes and then they are logged out) and a ...

I think that sets the expiration of the token within the response of the call to /libs/granite/csrf/token.json.  For example: {"token":"jsueUWBDOjE2NzgzODYyOTMsImlhdCI6MTY38DE34TY5M30.jdEhcW3JBPvdCyDOxfFM938EucIvIhKNF6VkeHmP5g"}   I don't think it's related to session or login token expiration.

I am setting the session timeout to 15 minutes (via the Apache Felix Jetty Based Http Service configuration).  However, the call to /libs/granite/csrf/token.json every 5 minutes seems to be keeping it active.  Should I adjust how often token.json is called?