One account. UUID-bound protection.

Start with an account UUID, then add each device with simple scan-and-pair enrollment.