1. better capsulation of the config
2. stricter signature checking (don't accept 2 sigs from tha same server as a valid permission)
3. First working =Auth2 / BEO version