Automatic state handling with `jwt`; specs done; bugfixes.

Overall fairly large update.

 * State checking is now mostly complete using JWT. Generation of the RFP value still being debated.
 * Expiration dates should be working now.
 * All the specs have been fleshed out, though still a little rough around the edges they get us to 100% coverage.