diff --git a/.coveragerc b/.coveragerc
new file mode 100644
index 0000000..d09fe9c
--- /dev/null
+++ b/.coveragerc
@@ -0,0 +1,5 @@
+[report]
+omit =
+    */python?.?/*
+    */site-packages/nose/*
+    tests.py
diff --git a/.travis.yml b/.travis.yml
index 8314d74..c973ea5 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,9 +1,9 @@
 language: python
 python:
-  - "2.7"
-# command to install dependencies
+  - 2.6
 install:
-#  - pip install -r requirements.txt --use-mirrors
-  - pip install toopher
-# command to run tests
-script: python tests.py
+  - pip install -r requirements.txt --use-mirrors
+script:
+  nosetests tests.py --with-coverage --cover-package=toopher
+after_success:
+  coveralls
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..dc36c5f
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,18 @@
+# ToopherAPI Python Client
+
+#### Python Version
+>=2.6.0
+
+#### Installing Dependencies
+Toopher uses [pip](https://pypi.python.org/pypi/pip) to install packages.
+
+To ensure all dependencies are up-to-date run:
+```shell
+$ pip install -r requirements.txt
+```
+
+#### Tests
+To run tests enter:
+```shell
+$ python tests.py
+```
diff --git a/README-Iframe.md b/README-Iframe.md
new file mode 100644
index 0000000..ed10347
--- /dev/null
+++ b/README-Iframe.md
@@ -0,0 +1,119 @@
+Authenticating using the Toopher `<iframe>`
+===========================================
+Toopher's `<iframe>`-based authentication flow is the simplest way for web developers to integrate Toopher Two-Factor Authentication into an application.
+
+## Toopher `<iframe>` Authentication Overview
+
+The `iframe`-based authentication flow works by inserting an `<iframe>` element into the HTML displayed to the user after a successful username/password validation (but before they are actually logged-in to the service).  The iframe URL is generated by our library and its content is served from the Toopher API server.  The iframe guides the user through the process of authenticating with Toopher.  Once complete, the iframe will return the result of the authentication to your server by `POST`ing the response via HTML to an endpoint of your choice.  Your server validates the cryptographic signature using our library which determines whether or not the user successfully authenticated.
+
+Two distinct iframe flows are required: 
+
+* the *Pairing* request is used to pair a user account with a particular mobile device (this is typically a one-time process)
+* the *Authentication* request to authenticate a particular action on behalf of a user
+
+## Authentication Workflow
+### Primary Authentication
+We recommend using some form of primary authentication before initiating a Toopher authentication request.  Typical primary authentication methods involve verifying that the user has a valid username and password to access the resource being protected.
+
+### Step 1: Embed a request in an `<iframe>`
+After verifying the user's primary authentication, but before Assuming the user's primary authentication checks out, the next step is to kickoff Toopher authentication.
+
+1. Generate a URI by specifying the request parameters to the library as detailed below
+1. Display a webpage to your user that embeds this URI within an iframe element.  The markup requirements for the iframe element are described in the "HTML Markup" section
+
+### Step 2: Validate the result
+1. Toopher-iframe results posted back to server
+1. Server calls `ToopherIframe.validate()` to verify that result is valid.  `.validate()` returns a `Map` of trusted data if the signature is valid, or throws a `SignatureValidationError` if the signature is invalid.
+1. The server should check for possible errors returned by the API in the `error_code` map entry
+1. If no errors were returned, the result of the authentication is in the `granted` map entry
+
+### HTML markup
+The `<iframe>` element must have an id of `toopher_iframe`.
+
+Pages that include the Toopher Authentication or Pairing iframe must include the accompanying javascript library `toopher-web.js` (located in `/assets/js/` in this repository).  Toopher's Authentication and Pairing `<iframe>` content is designed for a minimum size of 400x300 px.  In the example below, `{{IFRAME_REQUEST_URL}}` is the Authentication or Pairing URL generated by the ToopherIframe library.  `{{POSTBACK_URL}}` is the path on your server where the Toopher-Iframe will submit the result of the authentication when it is finished.
+
+```html
+<!-- toopher-web.js requires jQuery.  uncomment the following line to source it from CDNJS if it is not already included in your page -->
+<!-- <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/1.11.0/jquery.min.js"></script> -->
+<script src="/js/toopher-web.js"></script>
+<iframe id="toopher_iframe" src="{{IFRAME_REQUEST_URL}}" toopher_postback="{{POSTBACK_URL}}" style="display:inline-block; height:300px; width:100%;"></iframe>
+```
+
+There is no difference in the markup required for a Pairing vs. an Authentication iframe request (the generated URI embeds all relevant information).
+
+# Examples
+
+#### Generating an Authentication iframe URI
+Every Toopher Authentication session should include a unique `request_token` - a randomized string that is included in the signed request to the Toopher API and returned in the signed response from the Toopher `<iframe>`.  To guard against potential replay attacks, your code should validate that the returned `request_token` is the same one used to create the request.
+
+Creating a random request token and storing it in the server-side session using Django:
+
+```python
+import random, string
+request_token = ''.join(random.choice(string.lowercase + string.digits) for i in range(15))
+request.session['ToopherRequestToken'] = request_token
+```
+
+The Toopher Authentication API provides the requester a rich set of controls over authentication parameters.
+
+```python
+auth_iframe_url = iframe_api.auth_uri(username, reset_email, action_name, automation_allowed, challenge_required, request_token, requester_metadata, ttl);
+```
+
+For the simple case of authenticating a user at login, a `login_uri` helper method is available:
+
+```python
+login_iframe_url = iframe_api.login_uri(username, reset_email, request_token)
+```
+
+#### Generating a Pairing iframe URI
+
+```python
+pair_iframe_url = iframe_api.pair_uri(username, reset_email)
+```
+
+#### Validating postback data from Authentication iframe and parsing API errors
+In this example, `data` is a `dict` of the form data POSTed to your server from the Toopher Authentication iframe.  You should replace the commented blocks with code appropriate for the condition described in the comment.
+
+```python
+
+request_token = request.session.get('ToopherRequestToken')
+# invalidate the Request Token to guard against replay attacks
+if 'ToopherRequestToken' in request.session:
+    del request.session['ToopherRequestToken']
+
+try:
+    validated_data = iframe_api.validate(data, request_token)
+    if 'error_code' in validated_data:
+        error_code = validated_data['error_code']
+        # check for API errors
+
+        if error_code == toopher.ERROR_CODE_PAIRING_DEACTIVATED:
+            # User deleted the pairing on their mobile device.
+            # 
+            # Your server should display a Toopher Pairing iframe so their account can be re-paired
+            #
+        elif error_code == toopher.ERROR_CODE_USER_DISABLED:
+            # User has been marked as "Opt-Out" in the Toopher API
+            #
+            # If your service allows opt-out, the user should be granted access.
+            #
+        elif error_code == toopher.ERROR_CODE_USER_UNKNOWN:
+            # User has never authenticated with Toopher on this server
+            #
+            # Your server should display a Toopher Pairing iframe so their account can be paired
+            #
+    else:
+        # signature is valid, and no api errors.  check authentication result
+        auth_pending = validated_data.get('pending').lower() == 'true'
+        auth_granted = validated_data.get('granted').lower() == 'true'
+
+        # authentication_result is the ultimate result of Toopher second-factor authentication
+        authentication_result = auth_granted and not auth_pending
+except toopher.SignatureValidationError, e:
+    # signature was invalid.  User should not authenticated
+    # 
+    # e.message will return more information about what specifically
+    # went wrong (incorrect session token, expired TTL, invalid signature)
+    # 
+```
diff --git a/README.md b/README.md
index bb91b9f..6ad702b 100644
--- a/README.md
+++ b/README.md
@@ -1,13 +1,15 @@
 #ToopherPython
 
+[![Build Status](https://travis-ci.org/toopher/toopher-python.png?branch=master)](https://travis-ci.org/toopher/toopher-python)
+
 #### Introduction
 ToopherPython is a Toopher API library that simplifies the task of interfacing with the Toopher API from Python code.  This project wrangles all the required OAuth and JSON functionality so you can focus on just using the API.
 
 #### Learn the Toopher API
-Make sure you visit (http://dev.toopher.com) to get acquainted with the Toopher API fundamentals.  The documentation there will tell you the details about the operations this API wrapper library provides.
+Make sure you visit [https://dev.toopher.com](https://dev.toopher.com) to get acquainted with the Toopher API fundamentals.  The documentation there will tell you the details about the operations this API wrapper library provides.
 
 #### OAuth Authentication
-First off, to access the Toopher API you'll need to sign up for an account at the developers portal (http://dev.toopher.com) and create a "requester". When that process is complete, your requester is issued OAuth 1.0a credentials in the form of a consumer key and secret. Your key is used to identify your requester when Toopher interacts with your customers, and the secret is used to sign each request so that we know it is generated by you.  This library properly formats each request with your credentials automatically.
+First off, to access the Toopher API you'll need to sign up for an account at the [Toopher developers portal](https://dev.toopher.com) and create a "requester". When that process is complete, your requester is issued OAuth 1.0a credentials in the form of a consumer key and secret. Your key is used to identify your requester when Toopher interacts with your customers, and the secret is used to sign each request so that we know it is generated by you.  This library properly formats each request with your credentials automatically.
 
 #### The Toopher Two-Step
 Interacting with the Toopher web service involves two steps: pairing, and authenticating.
@@ -35,15 +37,46 @@ auth = api.authenticate(pairing_status.id, "my computer")
 
 # Once they've responded you can then check the status
 auth_status = api.get_authentication_status(auth.id)
-if (auth_status.pending == false and auth_status.granted == true):
+if (auth_status.pending == False and auth_status.granted == True):
 	# Success!
 ```
 
 #### Handling Errors
 If any request runs into an error a `ToopherApiError` will be thrown with more details on what went wrong.
 
+#### Zero-Storage usage option
+Requesters can choose to integrate the Toopher API in a way does not require storing any per-user data such as Pairing ID and Terminal ID - all of the storage
+is handled by the Toopher API Web Service, allowing your local database to remain unchanged.  If the Toopher API needs more data, it will `raise()` a specific
+error that allows your code to respond appropriately.
+
+```python
+try:
+    # optimistically try to authenticate against Toopher API with username and a Terminal Identifier
+    # Terminal Identifer is typically a randomly generated secure browser cookie.  It does not
+    # need to be human-readable
+    auth = api.authenticate_by_user_name(user_name, requester_terminal_id)
+
+    # if you got here, everything is good!  poll the auth request status as described above
+    # there are four distinct errors ToopherAPI can return if it needs more data
+except UserDisabledError:
+    # you have marked this user as disabled in the Toopher API.
+except UserUnknownError:
+    # This user has not yet paired a mobile device with their account.  Pair them
+    # using api.pair() as described above, then re-try authentication
+except TerminalUnknownError:
+    # This user has not assigned a "Friendly Name" to this terminal identifier.
+    # Prompt them to enter a terminal name, then submit that "friendly name" to
+    # the Toopher API:
+    #   api.create_user_terminal(user_name, terminal_name, requester_terminal_id)
+    # Afterwards, re-try authentication
+except PairingDeactivatedError:
+    # this user does not have an active pairing,
+    # typically because they deleted the pairing.  You can prompt
+    # the user to re-pair with a new mobile device.
+```
+
 #### Dependencies
-This library uses the python-oauth2 library to handle OAuth signing and httplib2 to make the web requests.  If you install using pip (or easy_install) they'll be installed automatically for you. 
+This library uses the [Requests](http://docs.python-requests.org/en/latest/) library to handle OAuth signing and to make the web requests.  If you install using pip (or easy_install) they'll be installed automatically for you. 
 
 #### Try it out
 Check out `demo.py` for an example program that walks you through the whole process!  Just download the contents of this repo, make sure you have the dependencies listed above installed, and then run it like-a-this:
diff --git a/demo_bells_and_whistles.py b/demo_bells_and_whistles.py
index eb56fb3..af924d5 100755
--- a/demo_bells_and_whistles.py
+++ b/demo_bells_and_whistles.py
@@ -53,10 +53,10 @@ def print_sep(char='-'):
             pair_type = 'pairing phrase'
         
         print pair_help
-        pairing_key = raw_input('Enter {0}: '.format(pair_type))
+        pairing_key = raw_input('Enter %s: ' % pair_type)
         while not pairing_key:
-            print 'Please enter a {0} to continue'.format(pair_type)
-            pairing_key = raw_input('Enter {0}: '.format(pair_type))
+            print 'Please enter a %s to continue' % pair_type
+            pairing_key = raw_input('Enter %s: ' % pair_type)
             
         user_name = raw_input('Enter a username for this pairing [%s]: ' % DEFAULT_USERNAME)
         if not user_name:
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..d9bf92f
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,11 @@
+PyYAML==3.11
+coverage==3.7
+coveralls==0.4.1
+docopt==0.6.1
+httpretty==0.7.0
+nose==1.3.0
+oauthlib==0.6.0
+requests==2.0.1
+requests-oauthlib==0.4.0
+urllib3==1.7.1
+Werkzeug==0.9.4
diff --git a/setup.py b/setup.py
index 7460b75..9618583 100755
--- a/setup.py
+++ b/setup.py
@@ -3,9 +3,9 @@
 
 setup(
     name='toopher',
-    version='1.0.5',
+    version='1.1.0',
     author='Toopher, Inc.',
-    author_email='support@toopher.com',
+    author_email='dev@toopher.com',
     url='https://dev.toopher.com',
     description='Wrapper library for the Toopher authentication API',
     classifiers=[
@@ -18,9 +18,6 @@
         'Topic :: Software Development :: Libraries :: Python Modules',
         ],
     packages=['toopher'],
-    package_data = {'toopher': ['toopher.pem']},
     test_suite='tests',
-    install_requires=[
-        'oauth2',
-        ]
+    install_requires=['requests-oauthlib>=0.4.0']
 )
diff --git a/tests.py b/tests.py
index eaf471b..c849a51 100644
--- a/tests.py
+++ b/tests.py
@@ -1,51 +1,141 @@
-import unittest
-import os
-import urlparse
-
+import json
 import toopher
+import requests
+import unittest
+import time
+import werkzeug.datastructures
 
 class HttpClientMock(object):
     def __init__(self, paths):
         self.paths = paths
 
-    def request(self, uri, method, data):
+    def request(self, method, uri, data=None, headers=None, params=None):
         self.last_called_uri = uri
         self.last_called_method = method
-        self.last_called_data = urlparse.parse_qs(data)
+        self.last_called_data = data if data else params
+        self.last_called_headers = headers
 
+        uri = uri.split(toopher.DEFAULT_BASE_URL)[1][1:]
         if uri in self.paths:
-            return self.paths[uri]
+            return ResponseMock(self.paths[uri])
         else:
-            return {'status':400}, None
+            return ResponseMock((400, '{}'))
+
+class ResponseMock(requests.Response):
+    def __init__(self, response):
+        self.encoding = 'utf-8'
+        self.status_code = int(response[0])
+        self._content = response[1]
+
+class ToopherIframeTests(unittest.TestCase):
+    request_token = 's9s7vsb'
+
+    def setUp(self):
+        self.iframe_api = toopher.ToopherIframe('abcdefg', 'hijklmnop')
+        self.iframe_api.client.nonce = '12345678'
+        self.old_time = time.time
+        time.time = lambda:1000
+
+    def tearDown(self):
+        time.time = self.old_time
+
+    def test_validate_good_signature_is_successful(self):
+        data = {
+                'foo':'bar',
+                'timestamp':'1000',
+                'session_token':ToopherIframeTests.request_token,
+                'toopher_sig':'6d2c7GlQssGmeYYGpcf+V/kirOI='
+                }
+        try:
+            self.iframe_api.validate(data, ToopherIframeTests.request_token)
+        except toopher.SignatureValidationError:
+            self.fail()
+
+    def test_arrays_get_flattened_for_validate(self):
+        data = {
+                'foo': [ 'bar' ],
+                'timestamp': [ '1000' ],
+                'session_token': [ ToopherIframeTests.request_token ],
+                'toopher_sig':[ '6d2c7GlQssGmeYYGpcf+V/kirOI=' ]
+                }
+        try:
+            self.iframe_api.validate(data, ToopherIframeTests.request_token)
+        except toopher.SignatureValidationError:
+            self.fail()
+
+    def test_immutable_dictionaries_get_copied_for_validate(self):
+        data = werkzeug.datastructures.ImmutableMultiDict([
+                ('foo', 'bar'),
+                ('timestamp', '1000'),
+                ('session_token', ToopherIframeTests.request_token),
+                ('toopher_sig', '6d2c7GlQssGmeYYGpcf+V/kirOI=')
+                ])
+        try:
+            self.iframe_api.validate(data, ToopherIframeTests.request_token)
+        except toopher.SignatureValidationError:
+            self.fail()
+
+    def test_get_pair_uri(self):
+        expected = 'https://api.toopher.test/v1/web/pair?username=jdoe&reset_email=jdoe%40example.com&expires=1100&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=UGlgBEUF6UZEhYPxevJeagqy6D4%3D'
+        self.assertEqual(expected, self.iframe_api.pair_uri('jdoe', 'jdoe@example.com'))
+
+    def test_get_manage_user_uri(self):
+        expected = 'https://api.toopher.test/v1/web/manage_user?username=jdoe&reset_email=jdoe%40example.com&expires=1100&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=sV8qoKnxJ3fxfP6AHNa0eNFxzJs%3D'
+        self.assertEqual(expected, self.iframe_api.manage_user_uri('jdoe', 'jdoe@example.com'))
+
+    def test_get_login_uri(self):
+        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&automation_allowed=True&reset_email=jdoe%40example.com&session_token=s9s7vsb&v=2&allow_inline_pairing=True&requester_metadata=None&challenge_required=False&expires=1100&action_name=Log+In&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=URVngBe35eP%2FiFOSQ5ZpuGEYcJs%3D'
+        self.assertEqual(expected, self.iframe_api.login_uri('jdoe', 'jdoe@example.com', ToopherIframeTests.request_token))
+
+    def test_get_login_uri_without_inline_pairing(self):
+        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&automation_allowed=True&reset_email=jdoe%40example.com&session_token=s9s7vsb&v=2&allow_inline_pairing=False&requester_metadata=None&challenge_required=False&expires=1100&action_name=Log+In&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=lbz2kuYG3BM2Y0mZLElbTiWPv8A%3D'
+        self.assertEqual(expected, self.iframe_api.login_uri('jdoe', 'jdoe@example.com', ToopherIframeTests.request_token, allow_inline_pairing=False))
 
 
 class ToopherTests(unittest.TestCase):
+    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
+
     def test_constructor(self):
-        with self.assertRaises(TypeError):
+        def fn():
             api = toopher.ToopherApi()
+        self.assertRaises(TypeError, fn)
+
+        api = toopher.ToopherApi('key', 'secret')
 
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+    def test_version_number_in_library(self):
+        major, minor, patch = toopher.VERSION.split('.')
+        self.assertTrue(int(major) >= 1)
+        self.assertTrue(int(minor) >= 0)
+        self.assertTrue(int(patch) >= 0)
+
+    def test_version_number_in_setup(self):
+        ''' Ensure that the setup.py file has the same version number as the toopher/__init__.py file '''
+        for line in open('setup.py'):
+            if "version" in line:
+                # in setup.py the version is written as "version='1.0.6'," so we need to remove version=' and ',
+                version_number = line.strip().replace("version='", "").replace("',", "")
+                self.assertEqual(version_number, toopher.VERSION)
 
     def test_create_pairing(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/pairings/create':(
-                {'status':'200'},
+            'pairings/create': (200,
                 '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}}'
                 )
             })
         pairing = api.pair('awkward turtle', 'some user')
 
         self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_phrase'], ['awkward turtle'])
-        with self.assertRaises(KeyError):
+        self.assertEqual(api.client.last_called_data['pairing_phrase'], 'awkward turtle')
+
+        def fn():
             self.assertEqual(api.client.last_called_data['test_param'], ['42'])
-    
+        self.assertRaises(KeyError, fn)
+
     def test_pairing_status(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/pairings/1':(
-                {'status':'200'},
+            'pairings/1': (200,
                 '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}}'
                 )
             })
@@ -57,30 +147,38 @@ def test_pairing_status(self):
         self.assertEqual(pairing.user_id, '1')
         self.assertTrue(pairing.enabled)
 
-        with self.assertRaises(KeyError):
+        def fn():
             foo = pairing.random_key
+        self.assertRaises(AttributeError, fn)
 
     def test_create_authentication_request(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/authentication_requests/initiate':(
-                {'status':'200'},
+            'authentication_requests/initiate': (200,
                 '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}}'
                 )
             })
         auth_request = api.authenticate('1', 'test terminal')
         self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_id'], ['1'])
-        self.assertEqual(api.client.last_called_data['terminal_name'], ['test terminal'])
-        with self.assertRaises(KeyError):
-            self.assertEqual(api.client.last_called_data['test_param'], ['42'])
+        self.assertEqual(api.client.last_called_data['pairing_id'], '1')
+        self.assertEqual(api.client.last_called_data['terminal_name'], 'test terminal')
+
+        def fn():
+            self.assertEqual(api.client.last_called_data['test_param'], '42')
+        self.assertRaises(KeyError, fn)
 
+        api.authenticate('pairing_id', 'terminal_name', 'action_name')
+
+        last_called_data = api.client.last_called_data
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertEqual(last_called_data['pairing_id'], 'pairing_id')
+        self.assertEqual(last_called_data['terminal_name'], 'terminal_name')
+        self.assertEqual(last_called_data['action_name'], 'action_name')
 
     def test_authentication_status(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/authentication_requests/1':(
-                {'status':'200'},
+            'authentication_requests/1': (200,
                 '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}}'
                 )
             })
@@ -94,42 +192,40 @@ def test_authentication_status(self):
         self.assertEqual(auth_request.terminal_id, '1')
         self.assertEqual(auth_request.terminal_name, 'test terminal')
 
-        with self.assertRaises(KeyError):
+        def fn():
             foo = auth_request.random_key
+        self.assertRaises(AttributeError, fn)
 
     def test_pass_arbitrary_parameters_on_pair(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/pairings/create':(
-                {'status':'200'},
+            'pairings/create': (200,
                 '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}}'
                 )
             })
         pairing = api.pair('awkward turtle', 'some user', test_param='42')
 
         self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_phrase'], ['awkward turtle'])
-        self.assertEqual(api.client.last_called_data['test_param'], ['42'])
+        self.assertEqual(api.client.last_called_data['pairing_phrase'], 'awkward turtle')
+        self.assertEqual(api.client.last_called_data['test_param'], '42')
 
     def test_pass_arbitrary_parameters_on_authenticate(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/authentication_requests/initiate':(
-                {'status':'200'},
+            'authentication_requests/initiate': (200,
                 '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}}'
                 )
             })
         auth_request = api.authenticate('1', 'test terminal', test_param='42')
         self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_id'], ['1'])
-        self.assertEqual(api.client.last_called_data['terminal_name'], ['test terminal'])
-        self.assertEqual(api.client.last_called_data['test_param'], ['42'])
+        self.assertEqual(api.client.last_called_data['pairing_id'], '1')
+        self.assertEqual(api.client.last_called_data['terminal_name'], 'test terminal')
+        self.assertEqual(api.client.last_called_data['test_param'], '42')
 
     def test_access_arbitrary_keys_in_pairing_status(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/pairings/1':(
-                {'status':'200'},
+            'pairings/1': (200,
                 '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}, "random_key":"84"}'
                 )
             })
@@ -143,12 +239,10 @@ def test_access_arbitrary_keys_in_pairing_status(self):
 
         self.assertEqual(pairing.random_key, "84")
 
-
     def test_access_arbitrary_keys_in_authentication_status(self):
-        api = toopher.ToopherApi('key', 'secret', api_url='http://testonly')
+        api = toopher.ToopherApi('key', 'secret')
         api.client = HttpClientMock({
-            'http://testonly/authentication_requests/1':(
-                {'status':'200'},
+            'authentication_requests/1': (200,
                 '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}, "random_key":"84"}'
                 )
             })
@@ -164,9 +258,220 @@ def test_access_arbitrary_keys_in_authentication_status(self):
 
         self.assertEqual(auth_request.random_key, "84")
 
+    def test_pair_qr(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'pairings/create/qr': (200,
+                json.dumps({'id': 'id',
+                            'enabled': True,
+                            'user': {'id': 'id', 'name': 'name'}}))})
+
+        api.pair_qr('user_name')
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertEqual(api.client.last_called_data['user_name'], 'user_name')
+
+    def test_pair_sms(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'pairings/create/sms': (200,
+                json.dumps({'id': 'id',
+                            'enabled': True,
+                            'user': {'id': 'id', 'name': 'name'}}))})
+
+        api.pair_sms('phone_number', 'user_name')
+        last_called_data = api.client.last_called_data
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertEqual(last_called_data['phone_number'], 'phone_number')
+        self.assertEqual(last_called_data['user_name'], 'user_name')
+
+        api.pair_sms('phone_number', 'user_name', 'phone_country')
+        last_called_data = api.client.last_called_data
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertEqual(last_called_data['phone_number'], 'phone_number')
+        self.assertEqual(last_called_data['user_name'], 'user_name')
+        self.assertEqual(last_called_data['phone_country'], 'phone_country')
+
+    def test_authenticate_with_otp(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/id/otp_auth': (200,
+                json.dumps({'id': 'id',
+                            'pending': False,
+                            'granted': False,
+                            'automated': False,
+                            'reason': 'it is a test',
+                            'terminal': {'id': 'id', 'name': 'name'}}))})
+
+        api.authenticate_with_otp('id', 'otp')
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertEqual(api.client.last_called_data['otp'], 'otp')
+
+    def test_bad_response_raises_correct_error(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/initiate': (200,
+                'lol if you think this is json')})
+
+        def fn():
+          api.authenticate_by_user_name('user_name', 'terminal_name')
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_unrecognized_error_still_raises_error(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({'error_code': 42,
+                            'error_message': 'what'}))})
+
+        def fn():
+            api.authenticate_by_user_name('user_name', 'terminal_name')
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+class ZeroStorageTests(unittest.TestCase):
+    def test_create_user_terminal(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({'user_terminals/create': (200, '{}')})
+
+        api.create_user_terminal('user_name', 'terminal_name', 'requester_terminal_id')
+
+        last_called_data = api.client.last_called_data
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertEqual(last_called_data['user_name'], 'user_name')
+        self.assertEqual(last_called_data['name'], 'terminal_name')
+        self.assertEqual(last_called_data['name_extra'], 'requester_terminal_id')
+
+    def test_enable_toopher_for_user(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'users': (200, json.dumps([{'id': 'user_id', 'name': 'user_name'}])),
+            'users/user_id': (200, json.dumps({'name': 'user_name'}))})
+
+        api.set_toopher_enabled_for_user('user_name', True)
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertFalse(api.client.last_called_data['disable_toopher_auth'])
+
+        api.set_toopher_enabled_for_user('user_name', False)
+        self.assertEqual(api.client.last_called_method, 'POST')
+        self.assertTrue(api.client.last_called_data['disable_toopher_auth'])
+
+    def test_enable_toopher_multiple_users(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({'users': (200,
+            json.dumps([{'name': 'first user'}, {'name': 'second user'}]))})
+
+        def fn():
+            api.set_toopher_enabled_for_user('multiple users', True)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_enable_toopher_no_users(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({'users': (200, '[]')})
+
+        def fn():
+            api.set_toopher_enabled_for_user('no users', True)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+
+
+    def test_disabled_user_raises_correct_error(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({'error_code': 704,
+                            'error_message': 'disabled user'}))})
+
+        def fn():
+            auth_request = api.authenticate_by_user_name('disabled user', 'terminal name')
+        self.assertRaises(toopher.UserDisabledError, fn)
+
+    def test_unknown_user_raises_correct_error(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({'error_code': 705,
+                             'error_message': 'unknown user'}))})
+
+        def fn():
+            auth_request = api.authenticate_by_user_name('unknown user', 'terminal name')
+        self.assertRaises(toopher.UserUnknownError, fn)
+
+    def test_unknown_terminal_raises_correct_error(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({'error_code': 706,
+                            'error_message': 'unknown terminal'}))})
+
+        def fn():
+            auth_request = api.authenticate_by_user_name('user', 'unknown terminal name')
+        self.assertRaises(toopher.TerminalUnknownError, fn)
+
+    def test_deactivated_pairing_raises_correct_error(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({'error_code': 707,
+                            'error_message': 'Pairing has been deactivated'}))})
+
+        def fn():
+            auth_request = api.authenticate_by_user_name('user', 'terminal name')
+        self.assertRaises(toopher.PairingDeactivatedError, fn)
+
+    def test_unauthorized_pairing_raises_correct_error(self):
+        api = toopher.ToopherApi('key', 'secret')
+        api.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({'error_code': 601,
+                            'error_message': 'Pairing has not been authorized'}))})
+
+        def fn():
+            auth_request = api.authenticate_by_user_name('user', 'terminal name')
+        self.assertRaises(toopher.PairingDeactivatedError, fn)
+
+class ddict(dict):
+    def __getitem__(self, key):
+        try:
+            value = super(ddict, self).__getitem__(key)
+            return value
+        except KeyError as e:
+            return ddict()
+
+class AuthenticationStatusTests(unittest.TestCase):
+    def test_incomplete_response_raises_exception(self):
+        response = {'key': 'value'}
+        def fn():
+            toopher.AuthenticationStatus(response)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_nonzero_when_granted(self):
+        response = ddict()
+        response['granted'] = True
+        allowed = toopher.AuthenticationStatus(response)
+        self.assertTrue(allowed)
+
+        response['granted'] = False
+        denied = toopher.AuthenticationStatus(response)
+        self.assertFalse(denied)
+
+class PairingStatusTests(unittest.TestCase):
+    def test_incomplete_response_raises_exception(self):
+        response = {'key': 'value'}
+        def fn():
+            toopher.PairingStatus(response)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_nonzero_when_granted(self):
+        response = ddict()
+        response['enabled'] = True
+        allowed = toopher.PairingStatus(response)
+        self.assertTrue(allowed)
+
+        response['enabled'] = False
+        denied = toopher.PairingStatus(response)
+        self.assertFalse(denied)
+
 def main():
     unittest.main()
 
 if __name__ == '__main__':
     main()
-
diff --git a/toopher/__init__.py b/toopher/__init__.py
index 8a1ef6c..5afa6e3 100644
--- a/toopher/__init__.py
+++ b/toopher/__init__.py
@@ -1,14 +1,130 @@
-import urllib
-import json
-import oauth2
 import os
+from oauthlib import oauth1
+import urllib
+import hashlib
+import hmac
+import base64
+import time
+import requests_oauthlib
+import sys
+
 DEFAULT_BASE_URL = "https://api.toopher.com/v1"
+DEFAULT_IFRAME_TTL = 100
+IFRAME_VERSION = '2'
+VERSION = '1.1.0'
+
+class ToopherApiError(Exception): pass
+class UserDisabledError(ToopherApiError): pass
+class UserUnknownError(ToopherApiError): pass
+class TerminalUnknownError(ToopherApiError): pass
+class PairingDeactivatedError(ToopherApiError): pass
+
+ERROR_CODE_USER_DISABLED = 704
+ERROR_CODE_USER_UNKNOWN = 705
+ERROR_CODE_TERMINAL_UNKNOWN = 706
+ERROR_CODE_PAIRING_DEACTIVATED = 707
+
+error_codes_to_errors = {ERROR_CODE_USER_DISABLED: UserDisabledError,
+                         ERROR_CODE_USER_UNKNOWN: UserUnknownError,
+                         ERROR_CODE_TERMINAL_UNKNOWN: TerminalUnknownError,
+                         ERROR_CODE_PAIRING_DEACTIVATED: PairingDeactivatedError}
+
+class SignatureValidationError(Exception): pass
+
+class ToopherIframe(object):
+
+    def __init__(self, key, secret, api_uri=None):
+        self.secret = secret
+        self.client = oauth1.Client(key, client_secret=secret, signature_type=oauth1.SIGNATURE_TYPE_QUERY)
+        api_uri = api_uri if api_uri else DEFAULT_BASE_URL
+        self.base_uri = api_uri.rstrip('/')
+
+    def pair_uri(self, username, reset_email, ttl = DEFAULT_IFRAME_TTL):
+        params = {
+                'v':IFRAME_VERSION,
+                'username':username,
+                'reset_email':reset_email
+                }
+        return self.get_oauth_uri(self.base_uri + '/web/pair', params, ttl)
+
+    def manage_user_uri(self, username, reset_email, ttl=DEFAULT_IFRAME_TTL):
+        params = {
+                'v':IFRAME_VERSION,
+                'username':username,
+                'reset_email':reset_email
+                }
+        return self.get_oauth_uri(self.base_uri + '/web/manage_user', params, ttl)
+
+    def auth_uri(self, username, reset_email, action_name, automation_allowed, challenge_required, request_token, requester_metadata, ttl=DEFAULT_IFRAME_TTL, allow_inline_pairing=True):
+        params = {
+                'v':IFRAME_VERSION,
+                'username':username,
+                'reset_email':reset_email,
+                'action_name':action_name,
+                'automation_allowed':automation_allowed,
+                'challenge_required':challenge_required,
+                'session_token':request_token,
+                'requester_metadata':requester_metadata,
+                'allow_inline_pairing':allow_inline_pairing
+                }
+        return self.get_oauth_uri(self.base_uri + '/web/authenticate', params, ttl)
+
+    def login_uri(self, username, reset_email, request_token, **kwargs):
+        return self.auth_uri(username, reset_email, 'Log In', True, False, request_token, 'None', DEFAULT_IFRAME_TTL, **kwargs)
+
+    def validate(self, data, request_token=None, ttl=DEFAULT_IFRAME_TTL):
+        # make a mutable copy of the data
+        data = dict(data)
+
+        # flatten data if necessary
+        if hasattr(data.values()[0], '__iter__'):
+            data = dict((k,v[0]) for (k,v) in data.items())
+
+        missing_keys = []
+        for required_key in ('toopher_sig', 'timestamp', 'session_token'):
+            if not required_key in data:
+                missing_keys.append(required_key)
+
+        if missing_keys:
+            raise SignatureValidationError("Missing required keys: {0}".format(missing_keys))
+
+        if request_token:
+            if request_token != data.get('session_token'):
+                raise SignatureValidationError("Session token does not match expected value!")
+
+        maybe_sig = data['toopher_sig']
+        del data['toopher_sig']
+        signature_valid = False
+        try:
+            computed_signature  =self.signature(data)
+            signature_valid = maybe_sig == computed_signature
+        except Exception, e:
+            raise SignatureValidationError("Error while calculating signature", e)
+
+        if not signature_valid:
+            raise SignatureValidationError("Computed signature does not match submitted signature: {0} vs {1}".format(computed_signature, maybe_sig))
+
+        ttl_valid = int(time.time()) - int(data['timestamp']) < ttl
+        if not ttl_valid:
+            raise SignatureValidationError("TTL expired")
+
+        return data
+
+    def signature(self, data):
+        to_sign = urllib.urlencode(sorted(data.items())).encode('utf-8')
+        secret = self.client.client_secret.encode('utf-8')
+        return base64.b64encode(hmac.new(secret, to_sign, hashlib.sha1).digest())
+
+    def get_oauth_uri(self, uri, params, ttl):
+        params['expires'] = str(int(time.time()) + ttl)
+        return self.client.sign(uri + '?' + urllib.urlencode(params))[0]
 
 
 class ToopherApi(object):
     def __init__(self, key, secret, api_url=None):
-        self.client = oauth2.Client(oauth2.Consumer(key, secret))
-        self.client.ca_certs = os.path.join(os.path.dirname(os.path.abspath(__file__)), "toopher.pem")
+        self.client = requests_oauthlib.OAuth1Session(key, client_secret=secret)
+        self.client.verify = True
+
         base_url = api_url if api_url else DEFAULT_BASE_URL
         self.base_url = base_url.rstrip('/')
 
@@ -18,24 +134,31 @@ def pair(self, pairing_phrase, user_name, **kwargs):
                   'user_name': user_name}
 
         params.update(kwargs)
-        
+
         result = self._request(uri, "POST", params)
         return PairingStatus(result)
 
+    def pair_qr(self, user_name, **kwargs):
+        uri = self.base_url + '/pairings/create/qr'
+        params = {'user_name': user_name}
+        params.update(kwargs)
+        result = self._request(uri, 'POST', params)
+        return PairingStatus(result)
+
     def pair_sms(self, phone_number, user_name, phone_country=None):
-        uri = BASE_URL + "/pairings/create/sms"
+        uri = self.base_url + "/pairings/create/sms"
         params = {'phone_number': phone_number,
                   'user_name': user_name}
-       
+
         if phone_country:
             params['phone_country'] = phone_country
 
         result = self._request(uri, "POST", params)
         return PairingStatus(result)
-        
+
     def get_pairing_status(self, pairing_id):
         uri = self.base_url + "/pairings/" + pairing_id
-        
+
         result = self._request(uri, "GET")
         return PairingStatus(result)
 
@@ -47,47 +170,80 @@ def authenticate(self, pairing_id, terminal_name, action_name=None, **kwargs):
             params['action_name'] = action_name
 
         params.update(kwargs)
-            
+
         result = self._request(uri, "POST", params)
         return AuthenticationStatus(result)
 
     def get_authentication_status(self, authentication_request_id):
         uri = self.base_url + "/authentication_requests/" + authentication_request_id
-        
+
         result = self._request(uri, "GET")
         return AuthenticationStatus(result)
 
     def authenticate_with_otp(self, authentication_request_id, otp):
-        uri = BASE_URL + "/authentication_requests/" + authentication_request_id + '/otp_auth'
+        uri = self.base_url + "/authentication_requests/" + authentication_request_id + '/otp_auth'
         params = {'otp' : otp}
         result = self._request(uri, "POST", params)
         return AuthenticationStatus(result)
-    
+
+    def authenticate_by_user_name(self, user_name, terminal_name_extra, action_name=None, **kwargs):
+        kwargs.update(user_name=user_name, terminal_name_extra=terminal_name_extra)
+        return self.authenticate('', '', action_name, **kwargs)
+
+    def create_user_terminal(self, user_name, terminal_name, requester_terminal_id):
+        uri = self.base_url + '/user_terminals/create'
+        params = {'user_name': user_name,
+                  'name': terminal_name,
+                  'name_extra': requester_terminal_id}
+        self._request(uri, 'POST', params)
+
+    def set_toopher_enabled_for_user(self, user_name, enabled):
+        uri = self.base_url + '/users'
+        params = {'name': user_name}
+        users = self._request(uri, 'GET', params)
+
+        if len(users) > 1:
+            raise ToopherApiError('Multiple users with name = %s' % user_name)
+        elif not len(users):
+            raise ToopherApiError('No users with name = %s' % user_name)
+
+        uri = self.base_url + '/users/' + users[0]['id']
+        params = {'disable_toopher_auth': not enabled}
+        self._request(uri, 'POST', params)
+
     def _request(self, uri, method, params=None):
-        data = urllib.urlencode(params or {})
-        
-        resp, content = self.client.request(uri, method, data)
-        if resp['status'] != '200':
-            try:
-                error_message = json.loads(content)['error_message']
-            except Exception:
-                error_message = content
-            raise ToopherApiError(error_message)
-        
+        data = {'params' if method == 'GET' else 'data': params}
+        header_data = {'User-Agent':'Toopher-Python/%s (Python %s)' % (VERSION, sys.version.split()[0])}
+
+        response = self.client.request(method, uri, headers=header_data, **data)
         try:
-            result = json.loads(content)
-        except Exception, e:
-            raise ToopherApiError("Response from server could not be decoded as JSON: %s" % e)
-        
-        return result
+            content = response.json()
+        except ValueError:
+            raise ToopherApiError('Response from server could not be decoded as JSON.')
+
+        if response.status_code >= 400:
+            self._parse_request_error(content)
 
+        return content
+
+    def _parse_request_error(self, content):
+        error_code = content['error_code']
+        error_message = content['error_message']
+        if error_code in error_codes_to_errors:
+            error = error_codes_to_errors[error_code]
+            raise error(error_message)
+
+        if 'pairing has not been authorized' in error_message.lower():
+            raise PairingDeactivatedError(error_message)
+
+        raise ToopherApiError(error_message)
 
 class PairingStatus(object):
     def __init__(self, json_response):
         try:
             self.id = json_response['id']
             self.enabled = json_response['enabled']
-            
+
             user = json_response['user']
             self.user_id = user['id']
             self.user_name = user['name']
@@ -95,12 +251,15 @@ def __init__(self, json_response):
             raise ToopherApiError("Could not parse pairing status from response" + e.message)
 
         self._raw_data = json_response
-        
+
     def __nonzero__(self):
         return self.enabled
 
     def __getattr__(self, name):
-        return self._raw_data[name]
+        if name.startswith('__') or name not in self._raw_data:  # Exclude 'magic' methods to allow for (un)pickling
+            return super(PairingStatus, self).__getattr__(name)
+        else:
+            return self._raw_data[name]
 
 
 class AuthenticationStatus(object):
@@ -111,7 +270,7 @@ def __init__(self, json_response):
             self.granted = json_response['granted']
             self.automated = json_response['automated']
             self.reason = json_response['reason']
-            
+
             terminal = json_response['terminal']
             self.terminal_id = terminal['id']
             self.terminal_name = terminal['name']
@@ -124,7 +283,10 @@ def __nonzero__(self):
         return self.granted
 
     def __getattr__(self, name):
-        return self._raw_data[name]
+        if name.startswith('__') or name not in self._raw_data:  # Exclude 'magic' methods to allow for (un)pickling
+            return super(AuthenticationStatus, self).__getattr__(name)
+        else:
+            return self._raw_data[name]
 
 
 class ToopherApiError(Exception): pass
diff --git a/toopher/toopher.pem b/toopher/toopher.pem
deleted file mode 100644
index d5b5b8a..0000000
--- a/toopher/toopher.pem
+++ /dev/null
@@ -1,20 +0,0 @@
-GlobalSign Root CA
-==================
------BEGIN CERTIFICATE-----
-MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx
-GTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jvb3QgQ0ExGzAZBgNVBAMTEkds
-b2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAwMDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNV
-BAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYD
-VQQDExJHbG9iYWxTaWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDa
-DuaZjc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavpxy0Sy6sc
-THAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp1Wrjsok6Vjk4bwY8iGlb
-Kk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdGsnUOhugZitVtbNV4FpWi6cgKOOvyJBNP
-c1STE4U6G7weNLWLBYy5d4ux2x8gkasJU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrX
-gzT/LCrBbBlDSgeF59N89iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
-HRMBAf8EBTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0BAQUF
-AAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOzyj1hTdNGCbM+w6Dj
-Y1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE38NflNUVyRRBnMRddWQVDf9VMOyG
-j/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymPAbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhH
-hm4qxFYxldBniYUr+WymXUadDKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveC
-X4XSQRjbgbMEHMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
------END CERTIFICATE-----