This works (includes some token sabotage code to ease testing), but I just realised there's probably no need for the additional temporary NS connection.
