I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them can access WCF service using their credentials. Should client pass credentials with every request or I can design login method which generates some token that can be used to access my service? Which is more secure? What are the requirments for token?