I'm using the login() API method to retrieve a session id from SalesForce that I then use in a number of following requests. For each set of requests I check if the token is older than 15 minutes (I have a 30 minute timeout).

Question 1: Sometimes when calling login() I receive an identical session id as I did in my previous call to login()? How is that possible, won't a call to login() always produce a fresh 30 minute token?

Question 2: If I request a token by login() and I receive a token that is about to timeout (assuming I don't always get a new one) I can end up in a situation where I timeout in the middle of my set of request. So is it then best practice to always wrap all calls and catch timeout exception and the request a new one?