[WIP] Token identification

First cut at this, any thoughts?
It'll only be the principal/firm stuff that'll require authentication