OA - Backport of bugfixes:
- Handle early authentication requests in the same trust session (LP #1376445)
- Handle requests from unconfined applications (LP #1380914)
- OA gives out all tokens to any app LP #1392380)