Always define AppConfig to get the nice error

NOTE: Config file may exist but running user may not
have access to it.

Change-Id: I1b46a08880821b9aaa02085447057bd34605a73f
disable xml parsing

Change-Id: I7abdd7c46f7be87edb68ba18b80f4dd754ad8080
Enforce token signature policy.

Change-Id: I2f1da05ddf5a6e215e6049eb8d88b839f4ce8e52
Merge branch 'upstream/cf/master' into develop