the request
Optionalsubject: unknown
the person signing in, to flag a token naming somebody else's device
null with no cookie or the feature off; { device: null, unreadable: true } for an unreadable one; otherwise the device, the
claims and the replayed, stale, foreign and contextChanged flags
Recognises the remembered browser a request carries, and flags what is odd about its token.
A replayed generation marks the device compromised here.