Tokenless auth does not support system scope

[Guang Yee]

One of the most useful features of X.509 tokenless is to enable services to validate user tokens without having to obtain a service auth token. However, with the migration to system scope, this feature is effectively broken as the default policies had been updated to require a system-scoped token for these operations. We'll need to update the X.509 tokenless feature to support system-scoped token. Perhaps this can also be done by using a new header to convey the system scope intention?