implement handshake prototype

So, I feel like this logic around tokens is a little complicated. I feel instinctively like all we need is a 5 min expirable token, but rather than guessing about things we should document our protocol, and have it reviewed by someone smarter like Mark Goodwin. I can do this part