The new (correct) behavior breaks the old (incorrect) logins. Add a config option to support legacy "issuer". Fix #35830