Second round work supporting security token endpoint