TSAS — issue of access control

After the initial interface (well known) presents an authentication
interface to
a client, and the client successfully authenticates, the initial interface
is then
"opened" to respond to the request for service.

However there are no tokens or cookies passed to the client for subsequent
use
on the initial interface, so how does the initial interface know that the
client who
was authenticated is the client who asks for service?

At least clarify that the authentication only opens the initial interface
for the service
request phase for a small amount of time. Perhaps it would be better to
have some
token passed by the authentication to the client to use with the initial
interface.

Additional parameter introduced, see also issue 4088