Little successes in getting the request/response right in reimplementing a dead device's cloud service is so satisfying.
Security questions? Sure. Lets start with these:
1) Who is your daddy?
2) What does he do?
I haven't see them yet on the device, because now it's asking me to make an account.

