Doh!!
This sucks. Ok, here's my workaround. This is for all you guys struggling with the same issue.
First, make a login call to the digi. The digi responds with a session id on success.
Store the session id in a javascript variable. Now create a heartbeat which calls on the digi every ... seconds, with the session id as parameter. The digi can now monitor the heartbeat and clear the specific session on timeout.
The client has to send the session id parameter on every call to the digi!!!
Good luck.