handshake API

because we proxy requests to the login server through the app servers, we need to forward the client IP for rate limiting purposes.