ASVS L1 walk over the wristband OIDC flavour, sm-oauthserver-plugin and the
sm-user-plugin additions. T-19.4-01..34 and T-19.4-SC verified or fixed (test
pins in summercms.go eaa545c and sm-oauthserver-plugin b4223be, f8eaf70);
new findings T-19.4-36..39 accepted with reasons; nothing left unresolved.