fix(solo): don't enforce origin identity; we have access tokens

[michaelfig]

While checking that the connections to our private parts (such as
the privileged CapTP) matched "localhost" and a few others was a
stopgap before we had an accessToken (capability), now it is
really a pain that impedes (but does not prevent) more general
access when a user wants it.

I believe it is now safe to remove this origin check, especially
since it can trivially be bypassed, it just is a nuisance.

[michaelfig]

@dckc, please try this PR against your gitpod stuff. It should solve #7032 's problems with connecting from a non-localhost Origin. That check was a kludge before we had accessTokens.

[dckc]

Please address the TODO about constant time compare in verifyToken as suggested below.

And updated outdated comment and function nam.e

[dckc]

yes, it does address the gitpod vs localhost issue. Thanks!

The URL surgery to take the localhost URL printed by agoric open and combine it with the right origin is tedious, but that's a separable issue, and not clearly one that's in-scope for agoric-sdk.

[dckc]

👍