Okay, so something has been brokeded in 4.5 IDP and Mobile Access....

Simple setup where IDP is subpathed off main URL (www.domain) and AAF is set up as domain (aaf.domain).

Since upgrade, when setting up Mobile Access, there are 404 responses at the back of www.domain for resources that should be called to aaf.domain (osp related), so it sounds like zero protection on Mobile Access by AAF

Don't see the same thing when authenticating through browser.