Difference between logontoken and serializedsession?

[first_last]

What is the conceptual difference between a logontoken and a serializedsession? Should I prefer one over the other?

ISessionMgr sessionMgr = CrystalEnterprise.GetSessionMgr();
IEnterpriseSession enterpriseSession = sessionMgr.Logon([userName], [password], [cmsName], [authentication]);

// create token
string token = enterpriseSession.LogonTokenMgr.DefaultToken
...
// use token to recreate new EnterpriseSession
IEnterpriseSession enterpriseSession = sessionMgr.LogonWithToken(token);

// create serialized session
string serializedSession = enterpriseSession.SerializedSession;

// use token to recreate new EnterpriseSession
IEnterpriseSession enterpriseSession = sessionMgr.getSession(serializedSession);

Does the LogonWithToken method hit the repository where the getSession method does not? Is one smaller (fewer bytes) than the other? Is one faster?

PS: is there a way to mark code inline, rather than using italics as I've done?

[TJe]

I'm using token or serialized session in my code:

public static enum TOKEN_TYPE {
	token, serializedSession
}

private void logon(String sessionToken, TOKEN_TYPE tokenType) throws Exception {
// Sends the logon request
Request request = new Request();
request.send(getBIP_RWS() + "/logon/token", "GET", null, false);
if (tokenType == TOKEN_TYPE.serializedSession) sessionToken = StringEscapeUtils.escapeXml(sessionToken);

// Sets logon information
Map<String, String> map = new HashMap<String, String>();
map.put("//attr[@name='tokenType']", tokenType.toString());
map.put("//attr[@name='logonToken']", sessionToken);

String filledLogonResponse = request.getResponseContent().replaceFirst("<attr name=\"logonToken\" type=\"string\"></attr>", "<attr name=\"logonToken\" type=\"string\">" + sessionToken + "</attr>");

// must specify the correct token type
filledLogonResponse = filledLogonResponse.replaceFirst(">token</attr>", ">" + tokenType.toString() + "</attr>");

// Posts logon information
request.send(getBIP_RWS() + "/logon/token", "POST", filledLogonResponse, false);
logonToken = request.getResponseHeaders().get("X-SAP-LogonToken").get(0);