Token-based authentication using GOV.UK SSO

Ah yes.  That's something that would be good to refactor, but that's well out of scope for this...