Trivial authentication bypass in Envoy

Envoy's OAuth filter fails to validate access tokens, allowing attackers to bypass authentication by simply attaching any access token to their request. This is critical because it completely breaks the security of OAuth-protected services.

The OAuth filter implementation lacks access token validation logic (CWE-306: Missing Authentication). When the HMAC-signed cookie is absent, the filter incorrectly assumes token validity instead of triggering re-authentication, allowing any request bearing an arbitrary access token to gain unauthorized access. Pre-condition: attacker must craft a request with a malformed or arbitrary access token; impact is complete authentication bypass affecting all OAuth-protected endpoints.