Document authorization events

Edit: using kentico 8.

When exactly do the DocumentEvents.CheckPermissions and DocumentEvents.AuthorizeDocument events run? What is the difference between them? From their descriptions, they seem very similar.

For certain specific pages I'd like to add event handling code that under certain circumstances forces the user to log in again, even if they are already logged in.

For example, if the user has permission to read WEBPAGE_X but they haven't done anything for over 10 minutes, I want to force them to log in again before they can view that particular page.

I'd be using ACLs to specify what roles can read that page.

Thank you.