Which layer would be the most suitable to be responsible for 

"The system shall request user credentials to establish a session that will be considered active unless it is explicitly terminated or there is inaction for 30 minutes."