How is the session authenticated?
Google proves its authenticity to the device during each request by offering its standard SSL Certificate, which the device should check. In turn, the device will prove its authenticity to Google during each request by transmitting a pre-assigned secret token to Google. The device is assigned this token as part of the activation process.