There seems to be no good reason to change group membership when exchanging tokens, let's try just passing the old one over.
Using CORS-enabled requests in the background.
Allow loading remote images.
Simplifies the device manager code as we don't have to duplicate the IP/network matching logic there.
Should make the subdivision between apps (idp, sso) more obvious.
Uses the clientutil.Backend abstraction for the keystore client API.
Also add a test to verify that we're loading the config correctly.
