A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option

Summary

A Basecamp API endpoint that hands a signed-in person off to their 37signals ID web session accepted any third-party OAuth token, including one an integration had been granted only for Basecamp data. An integration the victim had authorized could obtain a full 37signals ID web session, change their account settings, and keep that session after its access was revoked. The handoff now only honors the session bridge our own apps use, so third-party OAuth tokens can no longer mint a 37signals ID session through it. Thanks to @deivizzzz for a precise report.