Add a hashcode function
Add "enough" protection against use as a web service

Generate a hash from the session id and remote address using a randomly
generated UUID as a "salt".

If no hash is present when calling the validate servlet, send back a 403.