What Im mostly concerned about is restricting access to the functions. When I implemented this scheme in Axis2 I did a "create a nonce, have both sides encrypt it with a known key and compare. If they're equal then permit access to the functions." The problem Im trying to solve is how to know when a new connection is made so I can create a new nonce - and similarly to know when the existing connection has been properly 'authenticated' or not.
Its all 'session' management. If I can get cookies working I can probably get something going.