So I have implemented it, it all works. Happy to go back to using some other approach if this is not secure