An agent working on somebody's behalf used that person's credentials, and afterwards nothing could tell the two apart. An account now holds two grants on one DID, each with its own session, and an agent meeting only a person's login is refused rather than handed it. The scope pre-flight and every account-selecting command read the acting plane's grant, and a listing reads both account files once rather than once per row. Change-Id: I4ffea96f9af29057693d1b1eca6c95e6700a7b3a