checkpoint. 

key bootstrapping, 
session token encryption/description, 
new session token format, 
auth response templates,
everything up to fetching role, 
assigning new session token