Fix for switching idp.

Put back ensuring access for an idp. Throw a SecurityException when users spoofs the IDP header.