How a remote server proves who is calling: the discovery chain, resource indicators that bind a token to one server, and the passthrough ban that stops a confused deputy