IdP-token-based session creation makes requests to the authenticate
service to verify tokens. We have a singleflight group to avoid having
duplicate requests in flight, but it looks like this is not working as
intended. Move the IncomingIDPTokenSessionCreator initialization into
the main authorize state object, and out of the request path.
Add an integration test to assert that making a large number of requests
with the same IdP token will result in only one token verification
request to the authenticate service.
