There seems to be no good reason to change group membership when
exchanging tokens, let's try just passing the old one over.

Using CORS-enabled requests in the background.

Allow loading remote images.

Simplifies the device manager code as we don't have to duplicate the
IP/network matching logic there.

Should make the subdivision between apps (idp, sso) more obvious.

Uses the clientutil.Backend abstraction for the keystore client API.

Also add a test to verify that we're loading the config correctly.

It left the Prometheus instrumentation in server/http.go, while
it is already provided by the ai3/go-common package.