it can be loaded into the server to be authorized...
look at using signatures for items..
this involved restructing the objectstore to be more of a complete repo, keeping things like create_by_ref for new objects...