Wcf service authentication

I want to implement a web service that is in both java and .net.but, I first create a wcf service and later convert the code to java. for webservice security I have this in my opinion. I will be using the asp.net form authentication type. I intend to send a token to the client with a valid user ID and password to login. in return I would send a token. on all other maintenance operations, I have to validate the token.

Now I have a wcf client and a wcf service. what should be the shortest way forward? Should I use the autoth header to send the user id and password and how should I wrap the token (in which field? Http or soap?).

PS: Of course I will enable ssl later.