johnbest

This all seems a bit dubious - what about untrustworthy clients? If we identify the client based on a token on the server, then they can't make random claims about...