username/password login doesn't work with custom domains on the appliance

[mostekcm]

• Code snippet or sample project that reproduces the bug
  This ticket holds most of the information needed for this issue:
  https://auth0.zendesk.com/agent/tickets/15632

There are also a couple of slack conversations around this:
https://auth0.slack.com/archives/crew-brucke/p1483464530001405

The patch is here:
https://auth0.slack.com/archives/cs-ext-grean/p1476344821001423

• Lock version
  9, but the fix can be done in 10 only and we can force an upgrade.

• Browser & OS
  Chrome on Mac for sure
  Chrome on PC as well

There are a couple of places where the tenant is getting extracted from the URL. But the main blocker was that the issuer in the token was set to the tenant URL instead of the custom domain URL.

Replication steps:
Angular quickstart using lock will reproduce the issue. (really any lock quickstart).
Create an appliance with a custom domain for one of the tenants.
Attempt to log into the appliance setting the domain to the custom domain.
The lock SDK will reject the login due to the mismatched issuer and domain.