Now parsers response and creates claims. Added lots of (still failing) tests for additional security checks.