Closed #2 again.
Moved the client connection code into a one-shot Runnable scheduled to run by the single threaded client executor service.
Also added token validation.