Frank, you write:
"..The only issue with this [item 1, authentication] is that the token has a unlimited livetime today. We might have to change that..."
I imagine implementing a hash that works similar to how the session cookies work, where a component of the hash requires re-authenticating after a certain period and it ties in to existing session procs.
Since this is between machines, maybe it could use the shortest of the session intervals, SessionRenew (or a combination of SessionRenew and SessionTImeout ) in the kernel parameters etc.
Anyway, I'm not certain of the details beyond this.
