Kiosks

Registered devices. Each kiosk authenticates every request with its own token; revoking a device cuts it off immediately.