Editing TheFramework (section)

==Message Flow==
* CL=client
* GS=Gateway Server
* AS=Auth Server

* >>> CLIENT > GATEWAY Request Login: Username XXX, Password XXX, Magic=<RANDOM_BITS> SRC=CC_IP (should client send SRC IP?, it could waste space, but then again they ).
* CLIENT must add the Magic to some local list of magic's to ensure someone else doesn't send a fake response.
* GATEWAY Must ensure SRC is correct (or set it, of course UDP ip sources themselves can be spoofed. Does this need a handshake? Should AUTH or ).
* GATEWAY must forward the request to AS.
* >>> GATEWAY > AS Request Login: Username XXX, Password XXX, SRC=CC_IP.
* AS checks database or something...
* >>> AS > CLIENT Login OK, Magic Token (or signed thing). SRC=CC_IP


* Ensure AUTH can't be DOSed by spoofed IPs.
* Could require a PROOF_OF_IP_CONTROL handshake before doing the username auth stage. Should this be done by the AUTH or from the GATEWAY?
* How do you prevent the PROOF_OF_IP_CONTROL itself from being a DOS attack?