So: central server endpoint initiates the handshake; distributed server endpoint does the login based on the nonce.