Validate client credentials

Client credential verification is essentially one big TODO at the moment. We need to check that the credentials clients are presenting are valid, or there's really no point in having them.