finish xrpc work

leaving comment now before i forget: xrpc works now but doesnt actually validate against db and subdomain claims probably needs to be split off.