Authentication and Authorisation

Authentication: some way of authenticating a legit agent, preventing spoofing
Authorisation: Make sure an agent instance only has access to it's own session data
Backend API should support TLS - if so an agent in production mode can refuse to communicate over unencrypted connections (should be default mode, with a dev override).