user session management and authentication

given a use case where we are making a REST call from apliqo ux to a REST based service outside of apliqo.

we don’t want the user to re-enter the username and password and pass it on to the rest call for authentication. apliqo is already authenticating the user, is there a way to determine if the https request made from apliqo ux is a legitimate one ?

  1. may be if the sessionid of apliqo is passed, we may use it to check in tm1 to determine the calling user ??
  2. any info how does apliqo handle security or do session management ?