Replaced the d= parameter with the new | character logic
added handling for capturing the initial requestor's IP address

Added the ability to store the user's IP address when storing the nonce and updated the SQL to hold it.

Also added some more validation framework to the Validate object, but much of the functionality is still undefined in the spec.
fleshed out the validation code

The validation code should now be able to validate a SQRL request checking the enforce IP rules and that the security of the request has not been changed.

Also added a dedicated exception class to handle the various ways a request could fail validation.
update the test directory structure
Finished getting the base case signature check working for SqrlValidate

This will now check that a nonce exists in the database (if configured), check that the signed URL security matches the expected (qrl vs. sqrl), check that the IPs match if the enforce option is set, and check that the signature matches the URL requested.

Still to implement are tests to check how stale the nut is and also to store and retrieve user keys from the database.
More testing

Added another implementation test as described on the newsgroup. This just took a "real" client generated hash of the domain as the private key and generated the rest from there. Also fixed a couple tests in SqrlValidate that my previous updates broke.
functional test update

Changed the integration test to use a PHP array driven dataset instead of the XML dataset. This will allow us to create a generic database structure, yet still allow us to test for stale nuts using current time instead of having to create the database data manually in the test. We can also use utility functions to define the data instead of having to pre-caculate values (i.e. ip2long)
Added stale nonce handling

A nonce can now be checked for age. A new configuration setting was added to the sample JSON file allowing a user to set the number of minutes before a nonce is marked as stale. Added a check and test to the SqrlValidate class to check this age against the created value stored in the database.
finished user authentication testing.

Identity Lock and new user sign in still need to be implemented.
re-arranged the Validate object and began defining the request handler object

The new request handler object will handle parsing the request into its pieces and generating a response back to the client.
refactored the SqrlValidate object moving request parsing to new SqrlRequestHandler object

Also refactored the Exception object, removing exceptions that are now handled in error messages delivered to the client.
Added unit tests for the Request Handler
Updated documentation to match new system
Pulled storage communication into its own object

Moved the database communication and storage routines into a separate object that will store and retrieve nonces and user keys.
Added handling for all of the main SQRL actions

Now handled are: authorization requests that don't match an account, new account second loops, disable keys, re-key initial requests, re-enable key requests, migrate authentication key requests, migrate identlty lock request, and migrate all keys request.

The responses do not yet match the (incomplete) spec.
some crypto optimizations

Flattened the scalar mult function to speed that up. Was able to improve public key generation speeds significantly, but signature validation did not improve similarly. Also made some minor optimizations in the edwards() function
updated the server response format.

Changed it to match Steve's proposal here https://www.grc.com/sqrl/protocol.htm with updates to include a SQRL URL.
added code to send the response back to the user.
wrapped the response in the sqrlreply= value and URL encoded it.
added the storage and request handler to the unit test test suite