More work on PIN auth, starting on JSON deserialization