I need to develop a very secure login system. 

I have an API layer, and my plan is to create a token table. I'll send the username/password (Post) to my API and I generate a unique token (One time token with limited time), I return the token in JSON.

My questions are: 

1. What should be saved in the sessions while user is logged in. I want to store as little as possible information. Should I save the token only? Is it safe?
2. I don't want to store the access levels and user info in session, then I need to get these info each time via token.. what do you think? Advice!
3. Any other advice to develop more secure login system.

Thank you in advance.