Initial release with checks for expiry and service_id.

We are not using session nonces yet.