Unlocking medals

works, which means the encryption process works.  Need a static
API.unlockMedal(name) eventually.