manual rebase of arpa2:browser-implied-authentication, continues #602