- passing grant ID in lockbox get/set is not a good idea because it must be the same ID as passed into the lockbox access anyway and this could introduce weakness by re-passing the information since it needs to be verified anyway
- there is a case that the rolodex server token is no longer valid and must be considered