The HS now validates providerId -> authN consumer URL unions against federation metadata.