Interesting… so a web based AT Protocol client would have to rely on a backend api for verification?