* fix(web-backend): validate and pin every provider redirect hop * fix(web-backend): separate provider metadata from connection authority