Following from my last post bemoaning the lack of transport-level client crediential authentication when running inside IIS, I've started implementing my own encrypted session-transfer between clients and the server. I want to to use Http Headers as a primary way of broadcasting session i... [More]