I've installed a VM via foreman successfully but it was not marked as built. The cause seems to be a mixture of #5883 (token timeout/mismatch) and the additional complexity of my setup: the VM is behind a NAT, which supplies the http request with the IP address of an already built (but totally unrelated) system. Therefore UnattendedController#get_host_details matches on the NAT host (via UnattendedController#find_host_by_ip_or_mac), but immediately fails on the @host.build check in UnattendedController#allowed_to_install?.

It'd be great if the UnattendedController could just reject all requests with an invalid token, putting a specific error message into the log?