The sso service endpoint should send the proper CORS headers and
respond to OPTIONS (for CORS prefetches) so that XmlHttpRequests on
authenticated sites can (partially) work.

First step towards letting users pick the method they prefer.

Simplifies the device manager code as we don't have to duplicate the
IP/network matching logic there.

Uses the clientutil.Backend abstraction for the keystore client API.