- made certain a web based application must have gotten proven consent before even seeing any sensative materials (like lockbox key) even though there was already namespace protection
- made sure web application can't spoof a fake domain/application to which it belongs to the grant service
- added log level
- added proof of decryption key for identiy service
- changed http to https for all namespacing