public boolean getTokenHandler(Envelope message, Envelope response)
	{

		//check the number of contents
		if(message.getObjContents().size() < 4)
		{
			cEngine.writeAESEncrypted(genAndPrintErrorEnvelope("Message too short"), aesKey, output);
			return false;//go back and wait for a new message
		}

		Integer reqMsgNumber = (Integer)message.getObjContents().get(0); //Get the username
		String username = (String)message.getObjContents().get(1); //Get the username
		String pwd = (String)message.getObjContents().get(2);//get 
		PublicKey key = (PublicKey)message.getObjContents().get(3);

		//Matt, take Note -HMAC-
		if(!cEngine.checkHMAC(message, HMACKey)) return false;		

        //check message number
		if(msgNumber.intValue() != reqMsgNumber.intValue())
		{
			rejectMessageNumber(response, reqMsgNumber, output);
			return false;
		}
        System.out.println(cEngine.formatAsSuccess("Message number matches"));

		try
		{
			//NOTE: Its bad practice to tell the user what login error occurred
			//they could use it to fish for valid usernames
			if(username == null)
			{
				System.out.println(cEngine.formatAsError("No username"));
				cEngine.writeAESEncrypted(new Envelope("Login failed"), aesKey, output);
				return false;
			}
			else if(!my_gs.userList.checkUser(username))
			{
				System.out.println(cEngine.formatAsError("Username not found: "+username));
				cEngine.writeAESEncrypted(new Envelope("Login failed"), aesKey, output);
				return false;
			}
			else if(pwd == null || pwd.length() == 0)
			{
				System.out.println(cEngine.formatAsError("No password"));
				cEngine.writeAESEncrypted(new Envelope("Login failed"), aesKey, output);
				return false;
			}
			else if(!my_gs.userList.getUserPassword(username).equals(pwd))
			//else if(!my_gs.userList.checkUserPassword(username, cEngine.hashWithSHA(salt+pwd)))
			{
				System.out.println(cEngine.formatAsError("Wrong password: "+pwd));
				cEngine.writeAESEncrypted(new Envelope("Login failed"), aesKey, output);
				return false;
			}
			else
			{
				UserToken yourToken = createToken(username, key); //Create a token
				System.out.println(cEngine.formatAsSuccess("Authentication cleared"));
				
				msgNumber++;
				//Respond to the client. On error, the client will receive a null token
				response.addObject(msgNumber);
				response.addObject(yourToken);
				response.addObject(getGroupKeysForToken(yourToken));
				response = cEngine.attachHMAC(response, HMACKey);
				System.out.println(">> ("+msgNumber+"): Sending Reponse: OK");
				cEngine.writeAESEncrypted(response, aesKey, output);

				System.out.println(cEngine.formatAsSuccess("Token sent"));
				return true;
			}
		}
		catch(Exception e)
		{
			System.out.println(cEngine.formatAsError("Exception thrown during token setup"));
			e.printStackTrace();
			return false;
		}
	}