We're re-building a webservice that previously had it's own authentication and security model baked in. Instead of having the webservice handle this we're looking at switching to using Authenticated Sites license with a monthly login limit to let Salesforce handle that for us.
I'm digging through the salesforce license documentation and while I can find a very precise definition for what constitutes a page view in sites, I can't find any definition for what constitutes a login. The webservice is going to be consumed by external websites outside our control, so we're a little concerned that if they don't manage sessions well a single transaction could consume a large number of logins (i.e. if they stored the username/password and did a login call for each transaction).
Does anyone have details on how exactly this is determined?
If a session expires and we have to login again, does that count as a new login?
Is there a way to generate a longer duration access token (i.e. oauth) with Authenticate Sites licenses?